[cssom-view] Clarify GeometryUtils for pseudo-elements - #14131
[cssom-view] Clarify GeometryUtils for pseudo-elements#14131jogibear9988 wants to merge 2 commits into
Conversation
|
I created a implementation of this for chrome (https://chromium-review.googlesource.com/c/chromium/src/+/8039580) and during this some issues popped up |
|
maybe someone of you could review this additional request. Also added pseudo test's to my WPT pull req: https://github.com/web-platform-tests/wpt/pull/61015/commits |
|
Also, now I did a impl for Chrome: And a Chrome Status: |
|
So hopefully we get closer to deliver this at some time in the near future |
GeometryUtils coordinate conversion can traverse nested document boundaries. Checking only the origins of the endpoint nodes is insufficient: two same-origin documents can have a cross-origin document between them, allowing the inner document to observe layout information from that intermediate document.
Define the document chains participating in a conversion and require every document up to their common container document to be same-origin with the target node's document. Throw SecurityError before computing transforms when that condition is not met.
This prevents the cross-origin layout leak while retaining support for coordinate conversion across same-origin iframe hierarchies. Because the check is performed by convertPointFromNode(), it also applies to the quad, rectangle, and getBoxQuads({relativeTo}) paths built on top of point conversion.
Fixes w3c#14170
|
@emilio @whimboo @Psychpsyo |
emilio
left a comment
emilio
left a comment
There was a problem hiding this comment.
How exactly can you get your hands on nodes from two different origins in the same script without being an extension or so?
|
@emilio , the security issue (#14170) involves two nodes from the same origin but with a cross-origin frame between them. For example: Querying the geometry of a node in https://origin-a.com/inner.html relative to a node in https://origin-a.com/outer.html would reveal information from https://origin-b.com/middle.html, such as layout and scroll position. This information is partially available today with intersection observer, but this API would make it much easier to access. @jogibear9988's solution is to restrict the GeometryUtils API in cases where cross-origin information would be revealed while still allowing the cross-frame case as long as everything is same-origin. |
emilio
left a comment
emilio
left a comment
There was a problem hiding this comment.
Cool, I see, looks good.
I guess you could get a reasonable conversion between those by converting to the toplevel, but yeah not something we'd want to expose.
|
We need to do the IPR thing again @svgeesus |
|
are some of you also responsible for wpt tests? web-platform-tests/wpt#61015 |
|
Yes please file a bug in https://bugzilla.mozilla.org, thanks! |
will do when the spec change is merged |
|
@emilio any news to this? cause in chrome me pull req. is merge ready, but it implements also this |
3 participants
This clarifies how
GeometryUtilsapplies toCSSPseudoElementobjects.Changes
GeometryUtilsoperates on the boxes generated by the pseudo-element itself.::beforeand::after, including out-of-flow boxes such as absolutely positioned pseudos.getBoxQuads()returns an empty list when a pseudo-element generates no boxes.CSSPseudoElement.parentwhen walking transforms for nested pseudos.CSSPseudoElement.elementwhen resolving the node document.convertPointFromNode()flattens to 2D and ignoresz/w.convertQuadFromNode()/convertRectFromNode()algorithms into Bikeshed-friendly steps.Testing
git diff --checkcssom-view-1/Overview.bs