On Thu, Nov 30, 2017, at 03:53 AM, Emilio Cobos Álvarez wrote: > Hi again, > > In bug 1035091 I intend to remove support for the @-moz-document CSS > rule in content pages (more exactly in author stylesheets). > > The reasoning for this, apart from it being a non-standard mozilla-only > CSS feature, is that it's a possible security risk in presence of CSS > injection attacks (Freddy, CCd, can give more details about this, there > are also some links on the bug). > > Since it's a useful feature for user stylesheets, we're keeping it on > those. > > Let me know if there's any concern on doing this.
It may be worth checking how some popular extensions nowadays handle user style in different sites. If they insert rules containing @-moz-document, they may be broken with this change, although I wouldn't expect that to happen in WebExtensions... - Xidorn _______________________________________________ dev-platform mailing list dev-platform@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-platform
