You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -1789,9 +1794,7 @@ Changes from the <a href="https://www.w3.org/TR/2017/CR-css-ui-3-20170302/">2 Ma
1789
1794
<li>Align the spec with implementations, and make ''cursor: auto'' look like ''cursor/text'' over <strong>selectable</strong> text, and over editable elements (<a href="https://github.com/web-platform-tests/wpt/commit/34c61eff5eab4ebe9ff271e46658f73f18858c4f">corresponding tests</a>).
1790
1795
</ul>
1791
1796
1792
-
<h2 class="no-num" id="security-privacy-considerations">Appendix C. Considerations for Security and Privacy</h2>
<a href="https://w3ctag.github.io/security-questionnaire/">Self-Review Questionnaire: Security and Privacy</a>
@@ -1820,12 +1823,6 @@ Per the <a href="https://w3ctag.github.io/security-questionnaire/#questions">Que
1820
1823
<p>No.</p>
1821
1824
</li>
1822
1825
1823
-
<li>Does this specification enable new script execution/loading mechanisms?
1824
-
<p>Yes to loading, but not to execution. The 'cursor' property accepts <<image>> values which may include URLs to be loaded.
1825
-
These may be SVG documents which may contain scripts,
1826
-
but this specification requires that scripts must not be run.</p>
1827
-
</li>
1828
-
1829
1826
<li>Does this specification allow an origin access to a user’s location?
1830
1827
<p>No.</p>
1831
1828
</li>
@@ -1842,10 +1839,6 @@ but this specification requires that scripts must not be run.</p>
1842
1839
<p>No.</p>
1843
1840
</li>
1844
1841
1845
-
<li>Does this specification allow an origin some measure of control over a user agent’s native UI?
1846
-
<p>Yes. The 'cursor' and 'caret-color' properties enable the page to change the display of the cursor and text insertion caret of the user agent’s native UI. In addition the 'outline-style' property’s ''outline-style/auto'' value (and thus 'outline' shorthand) enable the page to potentially display a native focused element outline presentation around any element.</p>
1847
-
</li>
1848
-
1849
1842
<li>Does this specification expose temporary identifiers to the web?
1850
1843
<p>No.</p>
1851
1844
</li>
@@ -1861,17 +1854,36 @@ but this specification requires that scripts must not be run.</p>
1861
1854
<li>Does this specification persist data to a user’s local device?
<a href="https://w3ctag.github.io/security-questionnaire/">Self-Review Questionnaire: Security and Privacy</a>
1865
+
for editors of specifications to informatively answer.
1866
+
1867
+
Per the <a href="https://w3ctag.github.io/security-questionnaire/#questions">Questions to Consider</a>
1868
+
1869
+
<ol>
1870
+
<li>Does this specification enable new script execution/loading mechanisms?
1871
+
<p>Yes to loading, but not to execution. The 'cursor' property accepts <<image>> values which may include URLs to be loaded.
1872
+
These may be SVG documents which may contain scripts,
1873
+
but this specification requires that scripts must not be run.</p>
1874
+
</li>
1864
1875
1865
-
<li>Does this specification have a "Security Considerations" and "Privacy Considerations" section?
1866
-
<p>Yes.</p>
1876
+
<li>Does this specification allow an origin some measure of control over a user agent’s native UI?
1877
+
<p>Yes. The 'cursor' and 'caret-color' properties enable the page to change the display of the cursor and text insertion caret of the user agent’s native UI.
1878
+
In addition the 'outline-style' property’s ''outline-style/auto'' value (and thus 'outline' shorthand) enable the page to potentially display a native focused element outline presentation around any element.</p>
1867
1879
</li>
1868
1880
1869
1881
<li>Does this specification allow downgrading default security characteristics?
1870
1882
<p>No.</p>
1871
1883
</li>
1872
1884
</ol>
1873
1885
1874
-
<h2 class="no-num" id="default-style-sheet">Appendix D. Default style sheet additions for HTML</h2>
1886
+
<h2 class="no-num" id="default-style-sheet">Appendix E: Default style sheet additions for HTML</h2>
0 commit comments