8000 [css-forms-1] control-value() security and handling · Issue #11860 · w3c/csswg-drafts · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[css-forms-1] control-value() security and handling #11860

Open
tabatkins opened this issue Mar 6, 2025 · 2 comments
Open

[css-forms-1] control-value() security and handling #11860

tabatkins opened this issue Mar 6, 2025 · 2 comments
Labels
css-forms-1

Comments

@tabatkins
Copy link
Member

control-value() is morally equivalent to attr(), just with some special handling of the values since we know something about types. So, it should work identically to attr():

  • it's an "arbitrary substitution function"
  • it has the same tainting behavior as attr() (and so can't be used in a URL)
@lukewarlow
Copy link
Member

We should probably also refuse to expose password input values?

@tabatkins
Copy link
Member Author

Password input values aren't security-conscious in this context; the page already has access to them. (And they might even be visible, depending on your browser, if you click the "reveal password" UI.)

It would be bad for them to be exfiltrateable, but that's what attr() tainting solves.

cdoublev added a commit to cdoublev/css that referenced this issue Mar 9, 2025
@cdoublev
Upgrade dependencies
e293ddb 
- <attr()>: updated grammar
- <control-value()>: new function
- <random()>: updated grammar
- <random-caching-options>: updated grammar
- slider-orientation: new property

There are also a bunch of new pseudos from CSS Forms.

control-value() should be an arbitrary substitution (w3c/csswg-drafts#11860),
which is not implemented in this commit, and it should take a type as a keyword
(w3c/csswg-drafts#11842).

random() might now be simplified at parse time when <random-caching-options> is
specified as a <number>, which is not implemented in this commit.
@NachtEule01 NachtEule01 mentioned this issue Mar 16, 2025
Open
Sign up for free to join this 44E7 conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
css-forms-1
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tabatkins @lukewarlow
0