[css-fonts-4] Palette leakage needs tests
Open
@svgeesus is already working on this.
Since Aug 28, 2019.
css-fonts-4
Needs Testcase (WPT)
- Dominant language
- Bikeshed
- Stars
- 4.9k
- Forks
- 816
- PR merge metrics
- PR metrics pending
Description
An author-defined font color palette is only available to the documents that reference it. Using an author-defined color palette outside of the documents that reference it would constitute a security leak since the contents of one page would be able to affect other pages, something an attacker could use as an attack vector.
https://drafts.csswg.org/css-fonts-4/#font-palette-values
This is easily testable (two iframes, referencing the same font, one also has an @font-palette-values rule).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.