[whatwg] Selectors within <style scoped>

[Roland Steiner]

Hi Ian,

given the feedback in this thread it seems to me that limiting selector
matching within <style scoped> to the scope of the parent element -
including, but not exceeding it - would be a preferred default behavior.
With the addition that the presence of :scope or :root in a selector allows
the matching to exceed the scope, the author also doesn't lose flexibility
when it's needed.

Is it therefore possible to change the spec for <style scoped> to this new
behavior?


Cheers,

- Roland


On Fri, Jul 22, 2011 at 12:30 AM, <simon.madine at nokia.com> wrote:

> I've been working with a JS polyfill to enable scoped styles optionally
> including or excluding the direct parent element and, from a CSS writing
> point-of-view, it feels more natural to be able to affect the parent. The
> scoped block essentially has influence over the elements it can directly
> 'see' - parent and siblings.
>
> Either way, there's going to be a neutral container element so it comes
> down to whether that would be better provided by the author of the page or
> the author of the included block.
>
> Simon
>
>
>
> ________________________________________
> From: whatwg-bounces at lists.whatwg.org [whatwg-bounces at lists.whatwg.org] on
> behalf of ext Kornel Lesiński [kornel at geekhood.net]
> Sent: 20 July 2011 22:37
> To: ash at ashleysheridan.co.uk
> Cc: whatwg
> Subject: Re: [whatwg] Selectors within <style scoped>
>
> On Wed, 20 Jul 2011 20:55:51 +0100, Ashley Sheridan
> <ash at ashleysheridan.co.uk> wrote:
>
> >> <div id=widget>
> >>    <style scoped>
> >>      #widget foo {}
> >>    </style>
> >> </div>
> >
> > While I agree that that might be a common pattern, I disagree that it's
> > actually a good one. Consider an ad service which wraps everything in a
> > custom <div> tag. If the scope allowed the immediate parent to be
> > included as part of the scope, then it could allow the advert to be
> > altered in a way that could negatively affect the users of the site the
> > ad appeared on.
>
> The site could wrap the ad in another div to prevent that (and this is
> typical when the site wants to create fixed-size ad slot).
>
> > The purpose of scope in the style seems to be to protect elements
> > outside of the included content and to 'contain' the included content
> > that has the <style scoped> element in it, presumably because it's
> > coming from an external source. If you allowed the immediate parent as
> > your example, then it could allow the 3rd parties who created the advert
> > to take over the element beyond what the advert service would prefer to
> > be allowed.
>
> For rogue 3rd parties there's <iframe> in seamless and sandboxed flavors.
>
> If author is allowing untrusted and misbehaving code in the DOM, then it's
> already game over — the ad can do anything, including creating <style>
> without scope and modifying other stylesheets.
>
> Even scoped style could use position:absolute or fixed to modify looks of
> something outside the element.
>
> --
> regards, Kornel Lesiński
>