![]() :visited separated by various combinators.) (Consider selectors with multiple :link and Time, or something else? I suspect the answer is all, but I haven't had time to In other selectors into :-moz-any-link for the blocked properties, or one at a But what's the opposite? Do we turn all the :link It's clear that any selector using :visited doesn't applyįor the blocked properties. I also still need to solve the puzzle of exactly how to expand selectors for Much more comfortable doing this if the current CSS backend were cleaner. Properties, etc., especially when people start adding new properties. Of using a preprocessable list of properties - this makes it very easy to miss Implementing this in the current CSSīackend scares me, because everything is done in massive case statements instead The second part of the patch (see commentġ2) requires per-property knowledge. Then unblock background images, which I think are a legitimate style for Later patch I'd like to start loading background images from stylesheets and (For the timeīeing, this will have to block anything that can load an image, although in a Use of offsetTop of the frame in question or for other frames. Of GetComputedStyle for properties where it looks at frame geometry, etc., or This will prevent exploits using specification of properties and use Some sort to prevent some properties from applying when the selector has The second part of the patch (not yet written) will be to do rule splitting of Returning the wrong data for content nodes that don't have frames or for ![]() This patch also should fix a bunch of bugs in GetComputedStyle Significantly slower in the normal (no :visited) case than the current Point (and for nsComputedDOMStyle objects in general), but this shouldn't be Special style contexts - if I did, I'd have to worry about invalidation of theĬache, and that would be a real pain. More once I have the whole thing.) This approach doesn't do any caching of the (It also needs more testing, but I'll test it Splinter Review This is work in progress on a real fix for the exploit. Work in progress patch: fixes simple GetComputedStyle exploit (7)
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |