@@ -779,7 +779,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
779
779
780
780
781
781
782
- <!--ADD-TOPIC:Security-->
783
782
<h4>Writing secure applications with HTML</h4>
784
783
785
784
<!-- NON-NORMATIVE SECTION -->
@@ -899,7 +898,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
899
898
attribute).</p>
900
899
</dd>
901
900
</dl>
902
- <!--REMOVE-TOPIC:Security-->
903
901
904
902
905
903
<h4>Common pitfalls to avoid when using the scripting APIs</h4>
@@ -1190,7 +1188,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
1190
1188
</dd>
1191
1189
1192
1190
1193
- <!--ADD-TOPIC:Security-->
1194
1191
<dt>Errors that risk exposing authors to security attacks</dt>
1195
1192
1196
1193
<dd>
@@ -1203,7 +1200,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
1203
1200
1204
1201
</div>
1205
1202
</dd>
1206
- <!--REMOVE-TOPIC:Security-->
1207
1203
1208
1204
1209
1205
<dt>Cases where the author's intent is unclear</dt>
@@ -4489,15 +4485,13 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
4489
4485
neutral; leaving them in the DOM (for DOM processors), and styling them according to CSS (for CSS
4490
4486
processors), but not inferring any meaning from them.</p>
4491
4487
4492
- <!--ADD-TOPIC:Security-->
4493
4488
<p>When support for a feature is disabled (e.g. as an emergency measure to mitigate a security
4494
4489
problem, or to aid in development, or for performance reasons), user agents must act as if they
4495
4490
had no support for the feature whatsoever, and as if the feature was not mentioned in this
4496
4491
specification. For example, if a particular feature is accessed via an attribute in a Web IDL
4497
4492
interface, the attribute itself would be omitted from the objects that implement that interface
4498
4493
— leaving the attribute on the object but making it return null or throw an exception is
4499
4494
insufficient.</p>
4500
- <!--REMOVE-TOPIC:Security-->
4501
4495
4502
4496
</div>
4503
4497
@@ -39939,7 +39933,6 @@ dictionary <dfn dictionary>TrackEventInit</dfn> : <span>EventInit</span> {
39939
39933
</table>
39940
39934
39941
39935
39942
- <!--ADD-TOPIC:Security-->
39943
39936
<div w-nodev>
39944
39937
39945
39938
<h5>Security and privacy considerations</h5>
@@ -39981,7 +39974,6 @@ dictionary <dfn dictionary>TrackEventInit</dfn> : <span>EventInit</span> {
39981
39974
product, then being able to read the subtitles would present a serious confidentiality breach.</p>
39982
39975
39983
39976
</div>
39984
- <!--REMOVE-TOPIC:Security-->
39985
39977
39986
39978
39987
39979
<h5>Best practices for authors using media elements</h5>
@@ -59194,7 +59186,6 @@ interface <dfn interface>HTMLDialogElement</dfn> : <span>HTMLElement</span> {
59194
59186
</dd>
59195
59187
</dl>
59196
59188
59197
- <!--ADD-TOPIC:CSS-->
59198
59189
59199
59190
<div w-nodev>
59200
59191
@@ -62025,11 +62016,9 @@ callback <dfn callback>BlobCallback</dfn> = undefined (<span>Blob</span>? blob);
62025
62016
when invoked, must run these steps:</p>
62026
62017
62027
62018
<ol>
62028
- <!--ADD-TOPIC:Security-->
62029
62019
<li><p>If this <code>canvas</code> element's bitmap's <span
62030
62020
data-x="concept-canvas-origin-clean">origin-clean</span> flag is set to false, then throw a
62031
62021
<span>"<code>SecurityError</code>"</span> <code>DOMException</code>.</p>
62032
- <!--REMOVE-TOPIC:Security-->
62033
62022
62034
62023
<li><p>If this <code>canvas</code> element's bitmap has no pixels (i.e. either its horizontal
62035
62024
dimension or its vertical dimension is zero) then return the string "<code
@@ -62118,7 +62107,6 @@ callback <dfn callback>BlobCallback</dfn> = undefined (<span>Blob</span>? blob);
62118
62107
62119
62108
</div>
62120
62109
62121
- <!--REMOVE-TOPIC:DOM APIs-->
62122
62110
62123
62111
<h5 id="2dcontext">The 2D rendering context</h5>
62124
62112
@@ -62467,12 +62455,10 @@ interface <dfn interface>Path2D</dfn> {
62467
62455
<p>A <code>CanvasRenderingContext2D</code> object has an <dfn>output bitmap</dfn> that
62468
62456
is initialized when the object is created.</p>
62469
62457
62470
- <!--ADD-TOPIC:Security-->
62471
62458
<p>The <span>output bitmap</span> has an <span
62472
62459
data-x="concept-canvas-origin-clean">origin-clean</span> flag, which can be set to true or false.
62473
62460
Initially, when one of these bitmaps is created, its <span
62474
62461
data-x="concept-canvas-origin-clean">origin-clean</span> flag must be set to true.</p>
62475
- <!--REMOVE-TOPIC:Security-->
62476
62462
62477
62463
<p>The <code>CanvasRenderingContext2D</code> object also has an <dfn
62478
62464
data-x="concept-canvas-alpha">alpha</dfn> boolean. When a
@@ -80826,7 +80812,6 @@ dictionary <dfn dictionary>DragEventInit</dfn> : <span>MouseEventInit</span> {
80826
80812
80827
80813
80828
80814
80829
- <!--ADD-TOPIC:Security-->
80830
80815
<div w-nodev>
80831
80816
80832
80817
<h4>Security risks in the drag-and-drop model</h4>
@@ -80865,7 +80850,6 @@ dictionary <dfn dictionary>DragEventInit</dfn> : <span>MouseEventInit</span> {
80865
80850
</div>
80866
80851
80867
80852
</div>
80868
- <!--REMOVE-TOPIC:Security-->
80869
80853
80870
80854
80871
80855
@@ -105618,7 +105602,6 @@ function receiver(e) {
105618
105602
</div>
105619
105603
105620
105604
105621
- <!--ADD-TOPIC:Security-->
105622
105605
<h4 id="security-postmsg">Security</h4>
105623
105606
105624
105607
<div w-nodev>
@@ -105675,7 +105658,6 @@ function receiver(e) {
105675
105658
attacks.</p>
105676
105659
105677
105660
</div>
105678
- <!--REMOVE-TOPIC:Security-->
105679
105661
105680
105662
105681
105663
@@ -106666,8 +106648,6 @@ function showLogout() {
106666
106648
106667
106649
106668
106650
106669
- <!--ADD-TOPIC:Workers-->
106670
-
106671
106651
<h2 split-filename="workers" id="workers" dfn data-lt="web worker">Web workers</h2>
106672
106652
106673
106653
<h3>Introduction</h3>
@@ -126087,7 +126067,6 @@ interface <dfn interface>External</dfn> {
126087
126067
8bit (see the section on <span data-x="character encoding declaration">character encoding
126088
126068
declarations</span>)
126089
126069
</dd>
126090
- <!--ADD-TOPIC:Security-->
126091
126070
<dt>Security considerations:</dt>
126092
126071
<dd>
126093
126072
<p>Entire novels have been written about the security considerations that apply to HTML
@@ -126119,7 +126098,6 @@ interface <dfn interface>External</dfn> {
126119
126098
protected from cross-site request forgery attacks by unique tokens, and make use of any
126120
126099
third-party resources exposed to or rights granted to that origin.</p>
126121
126100
</dd>
126122
- <!--REMOVE-TOPIC:Security-->
126123
126101
<dt>Interoperability considerations:</dt>
126124
126102
<dd>
126125
126103
Rules for processing both conforming and non-conforming content
@@ -126195,14 +126173,12 @@ interface <dfn interface>External</dfn> {
126195
126173
<dd>No optional parameters.</dd>
126196
126174
<dt>Encoding considerations:</dt>
126197
126175
<dd>binary</dd>
126198
- <!--ADD-TOPIC:Security-->
126199
126176
<dt>Security considerations:</dt>
126200
126177
<dd>
126201
126178
Subresources of a <code>multipart/x-mixed-replace</code>
126202
126179
resource can be of any type, including types with non-trivial
126203
126180
security implications such as <code>text/html</code>.
126204
126181
</dd>
126205
- <!--REMOVE-TOPIC:Security-->
126206
126182
<dt>Interoperability considerations:</dt>
126207
126183
<dd>
126208
126184
None.
@@ -126270,10 +126246,8 @@ interface <dfn interface>External</dfn> {
126270
126246
<dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
126271
126247
<dt>Encoding considerations:</dt>
126272
126248
<dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
126273
- <!--ADD-TOPIC:Security-->
126274
126249
<dt>Security considerations:</dt>
126275
126250
<dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
126276
- <!--REMOVE-TOPIC:Security-->
126277
126251
<dt>Interoperability considerations:</dt>
126278
126252
<dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
126279
126253
<dt id="authors-using-xhtml">Published specification:</dt>
@@ -126343,14 +126317,12 @@ interface <dfn interface>External</dfn> {
126343
126317
</dd>
126344
126318
<dt>Encoding considerations:</dt>
126345
126319
<dd>Not applicable.</dd>
126346
- <!--ADD-TOPIC:Security-->
126347
126320
<dt>Security considerations:</dt>
126348
126321
<dd>
126349
126322
<p>If used exclusively in the fashion described in the context of
126350
126323
<span>hyperlink auditing</span>, this type introduces no new
126351
126324
security concerns.</p>
126352
126325
</dd>
126353
- <!--REMOVE-TOPIC:Security-->
126354
126326
<dt>Interoperability considerations:</dt>
126355
126327
<dd>
126356
126328
Rules applicable to this type are defined in this specification.
@@ -126414,10 +126386,8 @@ interface <dfn interface>External</dfn> {
126414
126386
<dd>Same as for <code>application/json</code> <ref spec=JSON></dd>
126415
126387
<dt>Encoding considerations:</dt>
126416
126388
<dd>8bit (always UTF-8)</dd>
126417
- <!--ADD-TOPIC:Security-->
126418
126389
<dt>Security considerations:</dt>
126419
126390
<dd>Same as for <code>application/json</code> <ref spec=JSON></dd>
126420
- <!--REMOVE-TOPIC:Security-->
126421
126391
<dt>Interoperability considerations:</dt>
126422
126392
<dd>Same as for <code>application/json</code> <ref spec=JSON></dd>
126423
126393
<dt>Published specification:</dt>
@@ -126496,7 +126466,6 @@ interface <dfn interface>External</dfn> {
126496
126466
</dd>
126497
126467
<dt>Encoding considerations:</dt>
126498
126468
<dd>8bit (always UTF-8)</dd>
126499
- <!--ADD-TOPIC:Security-->
126500
126469
<dt>Security considerations:</dt>
126501
126470
<dd>
126502
126471
<p>An event stream from an origin distinct from the origin of the content consuming the event
@@ -126511,7 +126480,6 @@ interface <dfn interface>External</dfn> {
126511
126480
reconnect rapidly. Servers should use a 5xx status code to indicate capacity problems, as this
126512
126481
will prevent conforming clients from reconnecting automatically.</p>
126513
126482
</dd>
126514
- <!--REMOVE-TOPIC:Security-->
126515
126483
<dt>Interoperability considerations:</dt>
126516
126484
<dd>
126517
126485
Rules for processing both conforming and non-conforming content are defined in this
0 commit comments