#635: Find the best terminology to restrict the usage of data urls

Visit on Github.

Opened May 13, 2021

Ya ya yawm TAG!

The category ("dispute escalation") is a misnomer; this is more a help/clarification request.

I'm requesting the TAG express an opinion on a problem related to:

  • Name: EPUB 3.3
  • Specification URL: https://www.w3.org/TR/epub-33/
  • Explainer (containing user needs and example code): (in preparation)
  • GitHub issues (if you prefer feedback filed there): https://github.com/w3c/epub-specs/issues/1592
  • Primary contacts (and their relationship to the specification): @mattgarrish @dauwhe @iherman (editors)
  • The group where the work on this specification is: EPUB 3 WG
  • Links to major pieces of multi-stakeholder review or discussion of this specification: n/a
  • Links to major unresolved issues or opposition with this specification: n/a
  • Relevant time constraints or deadlines: July 2021

We recommend the explainer to be in Markdown.

Explanation of the issue that we'd like the TAG's opinion on:

"There is no final agreement in the WG on how to precisely formulate the restrictions on the usage of data-url-s. The current formulation relies on the top-level browsing contexts term but that may not be adequate (e.g., if the top level document is an SVG file)."

Cc @ylafon

Discussions

2021-05-24

Minutes

Dan: missing some context here

Hadley: "reading systems mush prevent data URLs opening as if they are top level content documents..."

Hadley: why don't we invite someone from the wg to come and chat.

Hadley: [posts comment](https://github.com/w3ctag/design-reviews/issues/635#issuecomment-847666940

2021-07-26

Minutes

Amy: they have a para in their spec and they want out opinion ... They say "top level browsing context" and they may be refering to an SVG which isn't techically a top level browsing context so they want feedback. They have decided on behaviour, just want feedback on how to communicate it.

Yves: what is the origin when you navigate to a data URL? And do you use whether the document was sent using https to infer whether it can access powerful features, etc?

Dan: trying to figure out if the WHATWG PR is consistent with what Ivan is asking about

Hadley: MDN page says this already happens.

Amy: it is consistent with what the epub spec is asking for...

Yves: their spec says must prevent data url from opening in a top level browsing context. They say "browsing context" doesn't apply to SVG - only HTML. Something something Transcluded references - resources that are automatically downloaded like images and style?

Dan: could we just advise them to say "top level context"? Should they specify it in their doc?

Amy: or they could just say "in this context SVG also counts" [when referring].

Dan: I think that would be sufficient. But I'm not implementing epub readers...

Yves: should be secure contexts as well... there was an issue about if data URL is a secure context and the resolution was no ... do they require secure contexts or not? If they do then instead of using top level context you can say only for secure context documents - in that case it prevents Data URLs to be used.

Dan: let's leave those comments and maybe we can close it at the plenary if we get a response.

2021-08-09

Minutes

[closed on the basis of the PR]