Editorial: define read-back-allowed rendering - #12554

  Blockers
  
  1. source:153661 (+ 153599): Cross-origin frames aren't covered.
     - The dl says iframe/frame need nothing special because "CORS-same-origin frames are not sensitive". CORS-same-origin is defined on responses, and Fetch gives every navigate-mode request "basic" tainting. So by HTML's definition every frame is CORS-same-origin,
       cross-origin ones included.
     - object/embed also fetch with mode "navigate" (source:36716). So <object data="https://other.example/secret.png"> paints a cross-origin image the general rule never catches.
     - The explainer explicitly doesn't paint cross-origin iframes.
     - Fix: add a normative rule under Embedded content. Boxes of iframe/frame/embed/object whose content navigable's active document isn't same origin with the reference document (see S1) are invisible, and so is an object showing an image from a cross-origin URL.
       Same-origin navigables are rendered the same way, recursively. Replace the dl entry.
  2. source:151616: Cross-origin poster frames leak.
     - The poster is fetched no-cors (no mode is set, and crossorigin doesn't apply), but the rule only checks the media data.
     - <video poster="https://other.example/x.png"> with no media, or same-origin media, paints the cross-origin poster.
     - Fix: also cover video elements whose poster frame came from a CORS-cross-origin response.
  3. source:153599–153609: The general rule doesn't fit its own examples.
     - 'background-image' and 'border-image-source' don't generate boxes; they're painted inside the box of the element that uses them.
     - pattern and feImage generate no boxes at all, and SVG elements generate SVG layout boxes, not CSS boxes (source:149882).
     - So for these cases the rule either does nothing or, read loosely, hides the whole element.
     - Fix: phrase it in terms of image data: image data from a CORS-cross-origin response must not be painted (as if fully transparent), e.g. via CSS <image> values or SVG image/use/pattern/feImage.
  4. source:151733: input has no "current request".
     - Only img has one (source:32754), and the rule isn't limited to the Image Button state.
     - Fix: give input its own condition: in the Image Button state, with an image from a CORS-cross-origin response. Its fetch is no-cors (source:54575), so any cross-origin src qualifies.
  5. source:149857: It's unclear whether these "must"s bind anyone.
     - The Rendering intro says "must" isn't used in this section, and that "expected" only binds UAs that claim to support the suggested default rendering. It also says "User agents are not required to present HTML documents in any particular way".
     - The PR adds about a dozen "must"s without changing that intro. These are security requirements, so they have to bind every UA that does read-back-allowed rendering.
     - Fix: carve read-back-allowed rendering out in the intro, or move its requirements out of Rendering.
  6. source:153590: The new section is outside <div w-nodev>.
     - That div closes at source:153586, and everything else in Rendering is inside one. In the full build, the developer edition gets a stray "14.1 Read-back-allowed rendering" under "14 The XML syntax", with a dead #rendering link.
     - Meanwhile the author warning (source:151627) is inside w-nodev, so it's missing from the developer edition, which is the one authors read.
     - Fix: wrap the section in <div w-nodev>, and move the warning to the video element section or next to drawElementImage() in #11588.
  7. source:153349: The :visited wording is ambiguous on the one point that matters.
     - UAs do paint visited styles on screen; the privacy measures live in getComputedStyle() and the selector APIs. "Align with … style recalculation" can be read as "paint as usual", which is exactly the leak.
     - The earlier "act as if :visited does not match" was testable.
     - Fix: something like "the rendering must not depend on whether links have been visited, beyond what is otherwise observable to author code (e.g., getComputedStyle(), matches())". That still allows partitioned history.
  8. source:153614: "Subpixel text rendering and antialiasing must be disabled" literally bans all antialiasing.
     - The explainer only means subpixel (LCD) text antialiasing.
     - Fix: "text must not be rendered with subpixel antialiasing; grayscale antialiasing can be used instead".

  Suggestions

  1. source:153592–153597: The definition doesn't say what the concept is.
     - Define it positively: rendering whose output may be exposed to author code.
     - Say whose author code: the document the rendering is done for. Blocker 1 needs this.
     - Say that nested same-origin navigables are rendered this way too.
     - Make the general principle a normative catch-all, since every list is "including but not limited to".
     - Drop "The detailed requirements are in the relevant sections above", which the next paragraph repeats. Fix the agreement: "information … is omitted".
  2. source:151943, 153651: "Widgets must not use native appearance" doesn't say what they use instead.
     - Primitive appearance "can cause some widgets to disappear completely" (CSS UI 4), and base appearance isn't ready.
     - Native vs. devolved appearance also changes layout, so switching only at paint time is underspecified.
     - The table's "default appearance" isn't a defined term.
     - The explainer still calls form-control and scrollbar appearance non-sensitive. If that has changed, scrollbars and outline-style: auto focus rings (which use the accent color) presumably need the same treatment. Reconcile the two.
  3. source:153617: "Default colors, themes, and preferences must be used" has no limits. Read literally, it covers things already observable and baked into layout, like font-size preferences, prefers-color-scheme and forced-colors. Scope it to what isn't otherwise observable
     (e.g. system/accent colors in widgets, focus rings and selection) and give examples.
  4. source:153620, 153658:
     - Say whether author ::selection/::search-text styles still apply.
     - The dl says find-in-page needs nothing special, right after a find-in-page requirement; reword it as "highlights are painted, with default styles".
     - ::target-text isn't covered at all. The explainer calls it non-sensitive, but the text directive is deliberately hidden from script, so make the call explicit.
  5. source:151198: "Pending autofill suggestions" isn't defined and doesn't generate boxes. Tie it to autofill: values the UA shows that aren't yet exposed to author code (previews, or filled values not yet exposed through value) must not be painted.
  6. source:151620–151625: "Controls, subtitles, and captions" doesn't say of which element.
     - Use "expose a user interface to the user" for media elements. That also covers audio, as the table's "Media elements" row implies.
     - The note reads oddly after a rule with no condition; try "This applies regardless of whether the media data is CORS-same-origin."
  7. source:151627: The warning effectively tells authors not to provide captions. A better message: don't rely on this rendering for video that needs controls or captions; if you must, draw captions yourself from the track's active cues (mode "hidden").
  8. source:151582, 151616, 151732: The img/video/canvas conditions restate canvas's existing "is not origin-clean" check (source:73662) case by case. Referencing it keeps the two in sync and covers SVG image for free. The poster and input cases still need their own wording.
  9. Coverage gaps:
     - IME composition styling is on the explainer's sensitive list but isn't covered.
     - EME and isolated MediaStreams aren't CORS-cross-origin but mustn't be readable either. At least add a note that other specs are expected to hook into this concept; SVG already plans to.
  10. PR hygiene: "Editorial:" is defensible because nothing uses the concept yet. But the PR adds dormant normative UA requirements and an exported term SVG intends to use. Consider landing it with #11588, or at least write a commit message body that explains the label and
      links the explainer's "Read-back-allowed rendering" section.

  Nits

  1. source:151198: missing comma after "During read-back-allowed rendering"; every other instance has one.
  2. source:153600: "This includes … including but not limited to" → "This includes, but is not limited to:".
  3. source:153605–153608: the <li>s are indented 4 spaces; house style is 3.
  4. source:153659/153663: only one of the two <dd>s is closed with </dd>, and "Matching text from find-in-page" lacks a period.
  5. source:153351: "This specification does not specify" → "does not define".
  6. source:153353, 153621: the :link paragraph cuts the blank lines before <h4>The title attribute</h4> from 4 to 1. Keep at least 2 there and before <h4>Summary</h4>.
  7. source:153590, 153623: the h3 takes #read-back-allowed-rendering, so the exported definition ends up at #read-back-allowed-rendering-2 (I checked the build). <h4>Summary</h4> also claims the spec-wide #summary. Consider explicit ids.
  8. source:4214: the <url> definition anchor is #url-value; #urls is the section. The existing <length> entry does the same thing, so this is optional.
  9. source:153607, 153611: add SVG image to the examples. "Markers must be disabled" → "must not be painted", since "disabled" sounds like turning spellcheck off.
  10. source:153634: "Expected" is a defined term in this section; consider "Effect" as the column header.