Define read-back-allowed rendering #12554
+104
−0
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4210,6 +4210,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute | |
|
|
||
| <ul class="brief"> | ||
| <li><dfn data-x-href="https://drafts.csswg.org/css-values/#lengths"><length></dfn></li> | ||
| <li><dfn data-x-href="https://drafts.csswg.org/css-values/#urls"><url></dfn></li> | ||
| <li>The <dfn data-x-href="https://drafts.csswg.org/css-values/#em">'em'</dfn> unit</li> | ||
| <li>The <dfn data-x-href="https://drafts.csswg.org/css-values/#ex">'ex'</dfn> unit</li> | ||
| <li>The <dfn data-x-href="https://drafts.csswg.org/css-values/#vw">'vw'</dfn> unit</li> | ||
|
|
@@ -151193,6 +151194,9 @@ input:not([type=image i]), textarea { box-sizing: border-box; }</code></pre> | |
| <li><p>The <span>inner display type</span> is always 'flow-root'.</p></li> | ||
| </ul> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, pending autofill suggestions must not be | ||
| rendered.</p> | ||
|
|
||
|
|
||
| <h4>The <code>hr</code> element</h4> | ||
|
|
||
|
|
@@ -151573,6 +151577,10 @@ legend[align=right i] { | |
| the same <span>natural dimensions</span> as the element. Other <code>canvas</code> elements are | ||
| <span>expected</span> to be treated as ordinary elements in the rendering model.</p> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, <code>canvas</code> elements whose bitmap's | ||
| <span data-x="concept-canvas-origin-clean">origin-clean</span> flag is set to false must not be | ||
| rendered.</p> | ||
|
|
||
| <p>An <code>object</code> element that <span>represents</span> an image, plugin, or its | ||
| <span>content navigable</span> is <span>expected</span> to be treated as a <span>replaced | ||
| element</span>. Other <code>object</code> elements are <span>expected</span> to be treated as | ||
|
|
@@ -151602,6 +151610,16 @@ legend[align=right i] { | |
| <code>video</code> element, as defined by the relevant rendering rules; for WebVTT, those are the | ||
| <span>rules for updating the display of WebVTT text tracks</span>. <ref>WEBVTT</ref></p> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, <code>video</code> elements whose <span>media | ||
| data</span> is <span>CORS-cross-origin</span> must not be rendered.</p> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, controls, subtitles and captions must not be | ||
| rendered.</p> | ||
|
Contributor
There was a problem hiding this comment. And same here obvs. Note that, while CORS-violating images still leak sizing info, so observing the geometry via other layout effects doesn't leak any further info, this isn't necessarily true for these elements. Dunno if you can use anchorpos to observe their geometry indirectly, but if we assume that someday you can, this would be an info leak. We probably do mean "as if display:none" here, at least for subs/captions, then? They float on the video so there's no layout side-effects from making them not render boxes. Probably also useful to clarify that this applies to these elements even on non-CORS-cross-origin videos, just to contrast it with the preceding bullet point. |
||
|
|
||
| <p class="warning">This affects the accessibility of <code>video</code> elements. Authors are | ||
| strongly discouraged from using <code>video</code> elements with controls, subtitles or captions | ||
| in contexts that require <span>read-back-allowed rendering</span>.</p> | ||
|
|
||
| <p>When the user agent starts <span data-x="expose a user interface to the user">exposing a user | ||
| interface</span> for a <code>video</code> element, the user agent should run the <span>rules for | ||
| updating the text track rendering</span> of each of the <span data-x="text track">text | ||
|
|
@@ -151703,6 +151721,10 @@ iframe { border: 2px inset; } | |
| <span>expected</span> to provide access to the context menu that would have come up if the user | ||
| interacted with the actual image.</p> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, <code>img</code> and <code>input</code> | ||
| elements whose <span>current request</span>'s <span data-x="img-req-data">image data</span> is | ||
| <span>CORS-cross-origin</span> must not be rendered.</p> | ||
|
Contributor
There was a problem hiding this comment. Use the same clarification that you apply to replaced elements here. |
||
|
|
||
| <hr> | ||
|
|
||
| <p>All animated images with the same <span>absolute URL</span> and the same image data are | ||
|
|
@@ -151909,6 +151931,9 @@ input[type=image i][align=bottom i], object[align=bottom i] { | |
| <li><code>textarea</code></li> | ||
| </ul> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, <span data-x="widget">widgets</span> must not | ||
| use <span>native appearance</span>.</p> | ||
|
|
||
| </div> | ||
|
|
||
|
|
||
|
|
@@ -153312,6 +153337,10 @@ select { | |
| elements in their user interface, as discussed <a | ||
| href="#providing-users-with-a-means-to-follow-hyperlinks-created-using-the-link-element">previously</a>.</p> | ||
|
|
||
| <p>During <span>read-back-allowed rendering</span>, user agents are <span>expected</span> to act | ||
| as if the <code data-x="selector-visited">:visited</code> <span>pseudo-class</span> does not | ||
| match.</p> | ||
|
Contributor
There was a problem hiding this comment. Instead, point to https://drafts.csswg.org/selectors/#link and say that UAs must preserve privacy for :link/:visited in the same way that they do in other contexts. |
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
@@ -153550,6 +153579,81 @@ if (s = prompt('What is your name?')) { | |
|
|
||
|
|
||
|
|
||
| <h3>Read-back-allowed rendering</h3> | ||
|
|
||
| <p>During <dfn export>read-back-allowed rendering</dfn>, any security- or privacy-sensitive | ||
| information that isn't otherwise observable to author code are omitted or replaced with safe | ||
| defaults. The detailed requirements are in the relevant sections above.</p> | ||
|
|
||
| <p>Requirements for <span>read-back-allowed rendering</span> are given throughout <a | ||
| href="#rendering">the Rendering section</a>. Additionally, the following must not be rendered or | ||
| otherwise exposed during <span>read-back-allowed rendering</span>:</p> | ||
|
|
||
| <ul> | ||
| <li> | ||
| <p>Any <span>CORS-cross-origin</span> content in features defined by other specifications, | ||
| including but not limited to:</p> | ||
|
|
||
| <ul> | ||
| <li><p>CSS <span><url></span> references (e.g., <span>'background-image'</span>, | ||
| <span>'border-image-source'</span>)</p></li> | ||
| <li><p>SVG elements (e.g., <code data-x="">use</code>, <code | ||
| data-x="">pattern</code>, <code data-x="">feImage</code>)</p></li> | ||
| </ul> | ||
| </li> | ||
|
|
||
| <li><p>Non-default colors, themes, and preferences</p></li> | ||
|
|
||
| <li><p>Non-default selection and find-in-page highlights</p></li> | ||
|
|
||
| <li><p>Spelling and grammar markers</p></li> | ||
|
|
||
| <li><p>Subpixel text rendering and antialiasing</p></li> | ||
| </ul> | ||
|
|
||
| <h4>Summary</h4> | ||
|
|
||
| <!-- NON-NORMATIVE SECTION --> | ||
|
Contributor
There was a problem hiding this comment. Then obvs update this informative section to match whatever changes are made above. |
||
|
|
||
| <p>The following table summarizes how <span>read-back-allowed rendering</span> affects various | ||
| elements and features when they are rendered:</p> | ||
|
|
||
| <table> | ||
| <thead> | ||
| <tr> | ||
| <th>Category | ||
| <th>Expected behavior | ||
| <tbody> | ||
| <tr> | ||
| <td><code>a</code> and <code>area</code> elements | ||
| <td>The <code data-x="selector-visited">:visited</code> <span>pseudo-class</span> never matches. | ||
| <tr> | ||
| <td>Form controls | ||
| <td>Pending autofill suggestions are not rendered. | ||
| <tr> | ||
| <td><span data-x="replaced element">Replaced elements</span> | ||
| <td><span>CORS-cross-origin</span> content is not rendered. | ||
| <tr> | ||
| <td><span data-x="media element">Media elements</span> | ||
| <td>Controls, subtitles, and captions are not rendered. | ||
| <tr> | ||
| <td><span data-x="widget">Widgets</span> | ||
| <td>Widgets use default appearance, not <span>native appearance</span>. | ||
| </table> | ||
|
|
||
| <p>The following information does <em>not</em> have special requirements for | ||
| <span>read-back-allowed rendering</span> in this specification:</p> | ||
|
|
||
| <dl> | ||
| <dt>All content | ||
| <dd>Matching text from find-in-page | ||
|
|
||
| <dt><code>iframe</code> and <code>frame</code> elements | ||
| <dd><span>CORS-same-origin</span> frames are not sensitive information, but | ||
| <span>CORS-cross-origin</span> content within them is.</dd> | ||
| </dl> | ||
|
|
||
|
|
||
|
|
||
| <h2 split-filename="obsolete" id="obsolete">Obsolete features</h2> | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CSS specs already use the term "not rendered" to specifically mean "acts like
display:none". (See Images, where it's a condition, and Grid, where it's an effect like you're doing here.)Is this what we want? If so, we can just copy Grid's wording and say ", as if it were
display: none".This has layout effects, so if we instead want it to just not paint, we should use a different term to avoid the clash, and specify "as if it were
opacity: 0".Alternately, I think previous proposals in this space made them paint as solid opaque black, so the hole was observable and obvious in debugging.