Re: HTML spec changes about data: URIs and origins

2016-11-08 Thread smaug
On 11/07/2016 10:41 PM, smaug wrote: Just to get some idea how many tests would be broken: https://treeherder.mozilla.org/#/jobs?repo=try&revision=28735d0f2e5516c5a6d1f7805a065a6edbd8f28b The results show that quite a few tests need to be fixed, if we want to change data: handling. Should we

Re: HTML spec changes about data: URIs and origins

2016-11-07 Thread smaug
Just to get some idea how many tests would be broken: https://treeherder.mozilla.org/#/jobs?repo=try&revision=28735d0f2e5516c5a6d1f7805a065a6edbd8f28b On 09/13/2016 03:31 PM, Frederik Braun wrote: Firefox treats iframes pointing to a data URL as same-origin. This is all well-known, was part of

Re: HTML spec changes about data: URIs and origins

2016-09-14 Thread Boris Zbarsky
On 9/14/16 2:01 AM, Daniel Veditz wrote: ​Since Gecko is the only engine that behaves this way we can be reasonably sure we won't find public "must use Firefox" web sites depending on this behavior​. I wish that were true. In practice, I will be pleasantly surprised if we don't find such site

Re: HTML spec changes about data: URIs and origins

2016-09-13 Thread Daniel Veditz
On Tue, Sep 13, 2016 at 12:25 PM, Boris Zbarsky wrote: > Probably; we know they get created; what we don't know is how they're used. ​Since Gecko is the only engine that behaves this way we can be reasonably sure we won't find public "must use Firefox" web sites depending on this behavior​. Int

Re: HTML spec changes about data: URIs and origins

2016-09-13 Thread Boris Zbarsky
On 9/13/16 3:15 PM, Frederik Braun wrote: First of all, just to see how much breakage to expect when doing this on the web. Right, but my question is how you plan to measure that. So I wonder, is there a code path that we'd always call for DOM access to other window objects than the current g

Re: HTML spec changes about data: URIs and origins

2016-09-13 Thread Frederik Braun
On Tue, Sep 13, 2016 at 5:02 PM, Boris Zbarsky wrote: > On 9/13/16 8:31 AM, Frederik Braun wrote: >> I'd be happy to add a telemetry probe > > > For what, exactly? What do you propose to measure? > First of all, just to see how much breakage to expect when doing this on the web. So I wonder, is

Re: HTML spec changes about data: URIs and origins

2016-09-13 Thread Boris Zbarsky
On 9/13/16 8:31 AM, Frederik Braun wrote: Is back compat the main concern? Yes. Both for websites and addons. There's also a largish amount of work involved in auditing our tests to make sure the change doesn't make a bunch of security tests stop testing what they're trying to test, plus fi

Re: HTML spec changes about data: URIs and origins

2016-09-13 Thread Anne van Kesteren
On Tue, Sep 13, 2016 at 2:31 PM, Frederik Braun wrote: > Is back compat the main concern? I'd be happy to add a telemetry probe > and a devtools warning if someone is willing to point me in the right > direction. As I understand it the main potential problem is addons, coupled with internal tests

HTML spec changes about data: URIs and origins

2016-09-13 Thread Frederik Braun
Firefox treats iframes pointing to a data URL as same-origin. This is all well-known, was part of the HTML spec and has been discussed before [1,2] What has changed now is the HTML spec text[3]: Given that EdgeHTML, Webkit and Blink violated this requirement, the standard now turned around and ass