Add <meta name="responsive-embedded-sizing"> - #12444
Conversation
4f63023 to
5d63e86
Compare
This comment was marked as resolved.
This comment was marked as resolved.
|
https://html.spec.whatwg.org/#the-meta-element
But just below:
So |
This comment was marked as resolved.
This comment was marked as resolved.
|
@annevk can you help whether the @mtrootyy wrote:
|
5d63e86 to
ad98ae3
Compare
ad98ae3 to
49c5445
Compare
fe4fc74 to
615fb1c
Compare
There was a problem hiding this comment.
(Unofficial as I'm not an approver and we need multi implementer support)
I think this PR does the right thing in a way that's concise and consistent enough.
Editorially I can't say about maintaining the outdated wording style of existing meta tag or moving forward.
| <div algorithm> | ||
| <p>If a <code>meta</code> element is | ||
| <span data-x="node is inserted into a document">inserted into the document</span>, | ||
| the user agent must run the following algorithm:</p> |
There was a problem hiding this comment.
I think this wording style is outdated but will leave to @annevk whether this needs to be consistent with what's around it or with new style.
There was a problem hiding this comment.
OK I looked at other meta elements and you need to check for the name here. Are you ignoring the content? If so it's good to add a note.
Does changing the name attribute work? Is the matching case-sensitive?
Follow based on how other meta elements are speced.
There was a problem hiding this comment.
Thanks again, I read others and followed them. Can you check?
|
@kojiishi the tests link points to existing tests in wpt.fyi that are not marked tentative. |
I removed
Yes, I think so, though they're based on the previous understanding of the "immutable" in the CSS WG. Among the wpt tests:
I'll update/add tests and Blink once this discussion is settled down. |
| <div algorithm> | ||
| <p>If a <code>meta</code> element is | ||
| <span data-x="node is inserted into a document">inserted into the document</span>, | ||
| the user agent must run the following algorithm:</p> |
There was a problem hiding this comment.
OK I looked at other meta elements and you need to check for the name here. Are you ignoring the content? If so it's good to add a note.
Does changing the name attribute work? Is the matching case-sensitive?
Follow based on how other meta elements are speced.
615fb1c to
6404dc1
Compare
|
WHATNOT notes/minutes: Responsive Iframe Meta Tag Proposal: Noam Rosenthal introduced a proposal (PR 12444) to add a meta tag for responsive embedded sizing, which serves as an opt-in for parents to resize iframes. Luke questioned if domain-specific opt-ins are necessary, but Simon Pieters noted that CSP frame ancestors already provide existing protections. The group discussed whether the meta tag provides sufficient control over cross-origin information access, with Noam Rosenthal comparing the functionality to an explicit post-message opt-in. Responsive Iframe Data Leakage Concerns: The group discussed potential privacy risks, specifically whether responsive iframes could allow an origin to infer information about a user (e.g., whether they are logged into a site) based on size changes. Emilio Cobos Álvarez noted that the CSS working group previously discussed these risks and deemed them manageable if the parent page manages the sizing. Simon Pieters raised concerns regarding how to handle navigations and potential data leakage between pages. Responsive Iframe Implementation and Documentation: Luke suggested that browsers should provide console warnings if an iframe opts into this feature without appropriate frame ancestor restrictions. Noam Rosenthal committed to updating the security explainer for the PR and consulting with Koji to ensure privacy concerns are addressed. Philip Jägenstedt clarified that fence frames, while still present in Chromium code, are not currently being actively developed. |
|
I got another feedback from our security folks to add |
6404dc1 to
43cbcf8
Compare
43cbcf8 to
89778a0
Compare
This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8
This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715}
37fa621 to
7af5c6e
Compare
7af5c6e to
02d8b1e
Compare
| data-x="attr-meta-allowed-origins">allowed-origins</code> attribute, | ||
| or that attribute's value is not an <span>ancestor-source-list</span>, | ||
| or that attribute's value does not allow the <span | ||
| data-x="dom-hyperlink-origin">origin</span> of the <span | ||
| data-x="doc-container-document">container document</span> | ||
| by the <span>ancestor-source-list</span> syntax,</p></li> | ||
| </ul> |
There was a problem hiding this comment.
Indentation here seems wrong
There was a problem hiding this comment.
Fixed the first <p> to be in the next line of <li>. Others look the same as other places, is this what you meant?
New attributes shouldn't have dashes. Also maybe the name could be simplified to |
02d8b1e to
2a43d88
Compare
Thank you for catching this, @zcorpan. Fixed. |
2a43d88 to
6f46cac
Compare
This patch renames the attribute as per the WHATWG feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I185e7e7de5411bbfe5d1a6a1c972e05dba49101d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8173946 Auto-Submit: Koji Ishii <kojii@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1673080}
|
Actually, maybe the |
Yea that's probably better, like This shouldn't change anything security-wise. Are you ok with this @kojiishi ? |
| or that attribute's value does not allow the <span | ||
| data-x="concept-document-origin">origin</span> of <var>element</var>'s <code>node | ||
| document</code>'s <span data-x="doc-container-document">container document</span> | ||
| by the <span>ancestor-source-list</span> syntax,</p></li> |
There was a problem hiding this comment.
"allow ... by the ancestor-source-list syntax" should be changed to instead reference a defined matching algorithm. Maybe a new algorithm similar to https://w3c.github.io/webappsec-csp/#match-url-to-source-list but that takes two origins as input.
There was a problem hiding this comment.
Thanks, done, using the algorithm. I didn't understand the last part "but that takes two origins as input", but can you see if the new text resolves your feedback?
| document">inserted into the document</span>, or has its <code | ||
| data-x="attr-meta-name">name</code> or | ||
| <code data-x="attr-meta-alloworigins">alloworigins</code> attributes changed, | ||
| user agents must run the following algorithm:</p> |
There was a problem hiding this comment.
The matching of the parent origin allows obtaining if the parent origin is a specific origin, even if the parent attempted to hide its origin by using the referrerpolicy attribute (which hides the origin in location.ancestorOrigins, see #11560 ).
There was a problem hiding this comment.
Thanks for pointing this out. I read relevant text, and it looks to me that the origin is hidden in the Ancestor origins algorithm, but not the origin. Did I miss anything?
| <li><p><span>The body element</span> of <var>element</var>'s <code>node document</code> is | ||
| not null; or</p></li> |
There was a problem hiding this comment.
This claim in CSS does not hold with the current text in this PR:
Once set to either true or false, the flag will not change its value again for the lifetime of the Document.
In particular, the spec doesn't prevent rerunning these steps after the body element has been parsed, as script could remove the body element, then insert a meta element, then insert the body again.
If the intent is to freeze the policy when a meta element is found or when the body element is parsed, the value should be tri-state (undeclared, false, true), and only change once from undeclared to false or true, and the parser should set the value to false (if still undeclared) when inserting a body or frameset element. (Should this also happen in the XML parser case?)
The CSS spec should also be updated to let HTML cover this aspect, so that there aren't two conflicting definitions.
There was a problem hiding this comment.
You're right that currently this PR diverges from CSS. Our intention is to update the CSS spec once it is in consensus here. Ideally I think changing CSS to a link to HTML is the best way, but if it takes time to land this PR, we can add a copy there. /cc @tabatkins
This change is for a review comment on May 28:
I think you can use "body is null" like in https://html.spec.whatwg.org/multipage/dom.html#allows-adding-render-blocking-elements
I like using the precedence, but I'm also fine to define more strict immutable flag as you suggested.
There was a problem hiding this comment.
My thought was that aligning with render-blocking makes sense here, as the main essence of making this "immutable" is to not let people modify it while anything renderable exists.
One thing to take into account though is that CSS can make the <head> visible... So perhaps making this immutable is safer. Something like:
- unset/true/false
- If found, set to true
- when the body is seen, if unset, set to false
There was a problem hiding this comment.
Thank you for you two reaching a consensus. Updated.
I'm not sure what is the best place to set it to false, I did it in "Other parsing state flags" but your advice is greatly appreciated in advance.
There was a problem hiding this comment.
For render-blocking, is it possible to get back to a render-blocking state after the first render? If so maybe that should also be made stricter.
I think there are two approaches for "body is seen":
- Define HTML element insertion steps for
bodyandframesetto set the flag to false if unset and the parent is the roothtmlelement. (Not sure if HTML element moving steps are needed.)- This works for HTML parser case, XML parser case, and inserting elements with script case.
- Set the flag from the HTML parser whenever it would insert a
bodyorframesetelement.- This only works for the HTML parser case. The XML parser case needs to be defined separately (see https://html.spec.whatwg.org/#parsing-xhtml-documents ). Scripting case not covered.
I suspect the first option is simpler.
| <li><p>Set <var>element</var>'s <code>node document</code>'s | ||
| <span data-x="concept-document-responsive-embedded-sizing">responsive embedded sizing</span> | ||
| to true.</p></li> | ||
| </ol> |
There was a problem hiding this comment.
https://drafts.csswg.org/css-sizing-4/#iframe-frame-sizing says
Navigating the iframe’s document causes it to forget its locked embedded ICB size.
This should be formalized in HTML when and how this happens. In particular, if the old document's frame size is kept while the new document is loading, information can leak between origins. (The alloworigins list is a contract between embeddee and embedder, not between embeddee and a new document being navigated to.) The size must be reset before the new document has a chance to make detectable decisions based on the viewport size (for example loading an image from <picture><source media=...> or srcset/sizes in the preload scanner). (Or the new document has to act as if this has happened.)
There was a problem hiding this comment.
@tabatkins Can you help this feedback?
You're right about information can leak if the locked embedded ICB size is not reset, and this is to prevent that. The size is kept in CSS, I'm not sure how to define them in HTML.
Or even |
This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715} Co-authored-by: Koji Ishii <kojii@chromium.org>
6f46cac to
7afead6
Compare
Sounds good to me, and I like the simpler one. Updated to |
d5e89ad to
a9ecb3a
Compare
This adds `<meta name="responsive-embedded-sizing">` as an immutable standardized name. This is used by the CSS [responsive embedded sizing flag]. [responsive embedded sizing flag]: https://drafts.csswg.org/css-sizing-4/#document-responsive-embedded-sizing-flag
a9ecb3a to
e805016
Compare
For specifying the allowed origins, instead of adding a new attribute, as per the feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I78705424dd480737e1204f54e880a86071525c6d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8211759 Auto-Submit: Koji Ishii <kojii@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1674776}
This patch renames the attribute as per the WHATWG feedback[1]. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I185e7e7de5411bbfe5d1a6a1c972e05dba49101d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8173946 Auto-Submit: Koji Ishii <kojii@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Reviewed-by: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/main@{#1673080} Co-authored-by: Koji Ishii <kojii@chromium.org>
…bute, a=testonly Automatic update from web-platform-tests [iframe] Support `allowed-origins` attribute (#61344) This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715} Co-authored-by: Koji Ishii <kojii@chromium.org> -- wpt-commits: f1401e8ac6cac0cbe6f3008fbbc0edafd73b9d34 wpt-pr: 61344
This adds
<meta name="responsive-embedded-sizing">as an immutable standardized name.This is used by the CSS responsive embedded sizing flag.
(See WHATWG Working Mode: Changes for more details.)
/dom.html ( diff )
/infrastructure.html ( diff )
/parsing.html ( diff )
/semantics.html ( diff )