[css-cascade] Fill in some real security issues.

Author: tabatkins

css-cascade-3/Overview.bs

@@ -982,4 +982,20 @@ Additions to Level 2</h3>
 <h2 class="no-num" id="priv-sec">
 Privacy and Security Considerations</h2>
 
-	Issue: Something about ''@import'', since it's linking to other documents?
+	* The cascade process does not distinguish between same-origin and cross-origin stylesheets,
+		enabling the content of cross-origin stylesheets to be inferred
+		from the computed styles they apply to a document.
+
+	* User preferences and UA defaults expressed via application of style rules
+		are exposed by the cascade process,
+		and can be inferred from the computed styles they apply to a document.
+
+	* The ''@import'' rule does not apply the [=CORS protocol=] to loading cross-origin stylesheets,
+		instead allowing them to be freely imported and applied.
+
+	* The ''@import'' rule assumes that resources without <a href="https://html.spec.whatwg.org/multipage/infrastructure.html#content-type"><code>Content-Type</code> metadata</a>
+		(or any same-origin file if the host document is in quirks mode)
+		are <code>text/css</code>,
+		potentially allowing arbitrary files to be imported into the page
+		and interpreted as CSS,
+		potentially allowing sensitive data to be inferred from the computed styles they apply to a document.

css-cascade-4/Overview.bs

@@ -1073,4 +1073,20 @@ Additions to Level 2</h3>
 <h2 id=priv-sec>
 Privacy and Security Considerations</h2>
 
-	Issue: Something about ''@import'', since it's linking to other documents?
+	* The cascade process does not distinguish between same-origin and cross-origin stylesheets,
+		enabling the content of cross-origin stylesheets to be inferred
+		from the computed styles they apply to a document.
+
+	* User preferences and UA defaults expressed via application of style rules
+		are exposed by the cascade process,
+		and can be inferred from the computed styles they apply to a document.
+
+	* The ''@import'' rule does not apply the [=CORS protocol=] to loading cross-origin stylesheets,
+		instead allowing them to be freely imported and applied.
+
+	* The ''@import'' rule assumes that resources without <a href="https://html.spec.whatwg.org/multipage/infrastructure.html#content-type"><code>Content-Type</code> metadata</a>
+		(or any same-origin file if the host document is in quirks mode)
+		are <code>text/css</code>,
+		potentially allowing arbitrary files to be imported into the page
+		and interpreted as CSS,
+		potentially allowing sensitive data to be inferred from the computed styles they apply to a document.