Skip to content

[css-values-5][css-namespaces] CSS @namespace rules should probably not allow URLs with request modifiers #12077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
weinig opened this issue Apr 14, 2025 · 7 comments

Comments

@weinig
Copy link
Contributor

weinig commented Apr 14, 2025

The current grammar for CSS @namespace rules is:

@namespace <namespace-prefix>? [ <string> | <url> ] ;

Since it uses the <url> production, that means any URL modifiers defined, such as the request modifiers in CSS Values 5 should also parse.

I don't think it's meaningful for @namespace to have request modifiers (though I may be mistaken). I propose adding some way for specifications like @namespace to parse only the URL itself.

(cc @noamr, @annevk, @tabatkins, @fantasai)

@noamr
Copy link
Collaborator

noamr commented Apr 14, 2025

It could be useful that a URL defined elsewhere (e.g. a CSS property with a <url> type) can still be used here even if it has URL modifiers, and those can be ignored.

@annevk
Copy link
Member

annevk commented Apr 14, 2025

I don't think so? For namespaces using <url> at all was a mistake. (It's an interesting question as to whether these URLs even get parsed and can be relative.) We certainly don't want to make them more involved.

@svgeesus
Copy link
Contributor

The two URIs are treated as strings, and they are identical if and only if the strings are identical, that is, if they are the same sequence of characters
https://www.w3.org/TR/REC-xml-names/#iri-use

They are not parsed. They are case sensitive. No url un-escaping is done.

relative URIs are deprecated as namespace names

They are opaque strings which happen to be URLs

@noamr
Copy link
Collaborator

noamr commented Apr 14, 2025

If it's not useful to mix and match with CSS properties etc, it's a bit weird that they're using the <url> type.
I'd probably tend to let them have their own definition of string | url() | src() or some such that is not a <url> (if we want to keep the url() backwards compat);

That definition can live in the @namespace definition or alongside the url definition, it doesn't really matter.

@annevk
Copy link
Member

annevk commented Apr 15, 2025

Yeah, we should probably replace <url> with <url()> and call it a day. I don't think src() is needed.

@svgeesus that's the XML definition. It seems that for CSS that applies as well and user agents cannot eagerly parse the contents of url() as a URL and have to retain the original input. https://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A%3Cstyle%3E%0A%40namespace%20test%20url(%22%2F%22)%3B%0Atest%7Ctest%20%7B%20background%3Alime%20%7D%0A%3C%2Fstyle%3E%0A.%3Cscript%3E%0Atest%20%3D%20document.createElementNS(%22%2F%22%2C%20%22test%22)%3B%0Atest.textContent%20%3D%20%22test%22%3B%0Adocument.body.append(test)%3B%0A%3C%2Fscript%3E

@weinig
Copy link
Contributor Author

weinig commented Apr 16, 2025

Since <url()> includes the modifiers, I think you probably want this:

@namespace <namespace-prefix>? [ <string> | <url-token> | url( <string> ) ] ;

@noamr
Copy link
Collaborator

noamr commented Apr 17, 2025

Since <url()> includes the modifiers, I think you probably want this:

@namespace <namespace-prefix>? [ <string> | <url-token> | url( <string> ) ] ;

I'm fine with proposing an async resolution for this. @fantasai are you OK with that as the spec editor?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants