You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Clarify that all “aliases” of a property are reverted by ''revert''/''revert-layer''.
2068
-
* Clarify that style sheets are ordered in [[final CSS style sheets]] order.
2082
+
* Clarify that style sheets are ordered in [=final CSS style sheets=] order.
2069
2083
* Clarify that only ''@layer'' statement rules are ignored when checking validity of ''@import'', not empty ''@layer'' block rules.
2070
2084
2071
2085
<h3 id="changes-2021-10">
@@ -2191,8 +2205,8 @@ Additions Since Level 2</h3>
2191
2205
and Boris Zbarsky
2192
2206
contributed to this specification.
2193
2207
2194
-
<h2 class=no-num id=priv-sec>
2195
-
Privacy and Security Considerations</h2>
2208
+
<h2 class=no-num id=privacy>
2209
+
Privacy Considerations</h2>
2196
2210
2197
2211
* The cascade process does not distinguish between same-origin and cross-origin stylesheets,
2198
2212
enabling the content of cross-origin stylesheets to be inferred
@@ -2202,12 +2216,15 @@ Privacy and Security Considerations</h2>
2202
2216
are exposed by the cascade process,
2203
2217
and can be inferred from the computed styles they apply to a document.
2204
2218
2205
-
* The ''@import'' rule does not apply the [=CORS protocol=] to loading cross-origin stylesheets,
2206
-
instead allowing them to be freely imported and applied.
2207
-
2208
2219
* The ''@import'' rule assumes that resources without <a href="https://html.spec.whatwg.org/multipage/urls-and-fetching.html#content-type"><code>Content-Type</code> metadata</a>
2209
2220
(or any same-origin file if the host document is in quirks mode)
2210
2221
are <code>text/css</code>,
2211
2222
potentially allowing arbitrary files to be imported into the page
2212
2223
and interpreted as CSS,
2213
2224
potentially allowing sensitive data to be inferred from the computed styles they apply to a document.
2225
+
2226
+
<h2 class=no-num id=security>
2227
+
Security Considerations</h2>
2228
+
2229
+
* The ''@import'' rule does not apply the [=CORS protocol=] to loading cross-origin stylesheets,
2230
+
instead allowing them to be freely imported and applied.
0 commit comments