| 05:41 | <annevk> | smaug____: hmm I think you might be onto something |
| 05:42 | <annevk> | We should store the slot value before setting the attribute to the empty string and then restore it |
| 08:19 | <mkwst> | smaug____: I'd be happy to help review changes to HTML and/or CSP, and if we need to make changes to Chrome to accommodate, I'll try to find people to do so. Thank you for looking into this! |
| 08:22 | <annevk> | mkwst: I think if we add two steps to the second algorithm itโs all good |
| 08:22 | <annevk> | For nonce, that is |
| 10:27 | <smaug____> | annevk: "restore" it? |
| 10:27 | <smaug____> | you mean after setting content attribute? |
| 10:33 | <annevk> | smaug____: yeah |
| 10:33 | <annevk> | smaug____: I'll write a quick PR to show what I mean |
| 10:39 | <smaug____> | annevk: why the restore, if setting content attribute doesn't affect to the slot value |
| 10:40 | <annevk> | smaug____: setting the content attribute does affect the slot |
| 10:40 | <annevk> | smaug____: otherwise the slot wouldn't be set at all |
| 10:41 | <smaug____> | well, unless the slot is set just before the setAttribute(nonce, emptystring) |
| 10:44 | <smaug____> | maybe that isn't backwards compatible ? |
| 10:45 | <smaug____> | so setting attr really needs to affect to the slot |
| 10:47 | <annevk> | smaug____: I'm not sure I understand your proposed setup |
| 10:47 | <annevk> | smaug____: it needs to be able to be set through a content attribute as that's how it comes from the parser |
| 10:48 | <annevk> | smaug____: https://github.com/whatwg/html/pull/5300 is my patch |
| 10:48 | <smaug____> | annevk: only update slot when element is connected |
| 10:49 | <smaug____> | that would work with parser, since it sets attributes first, then when connecting, we'd take the attr value and store it in a slot and set attr to empty string |
| 10:51 | <annevk> | smaug____: that's an interesting alternative model |
| 10:51 | <annevk> | smaug____: ugh |
| 10:52 | <annevk> | smaug____: okay let me do some git blame |
| 10:52 | <annevk> | or more like git log --grep |
| 10:53 | <smaug____> | but I guess if one really wants to use setAttribute to change nonce, perhaps it should be possible. Or at least it has worked so far |
| 10:59 | <annevk> | smaug____: this was discussed at https://github.com/whatwg/html/pull/2373 too |
| 11:00 | <annevk> | smaug____: a problem with this alternative approach is that .nonce would be awkward (or return either the slot or content attribute or some such) |
| 11:04 | <smaug____> | well, .nonce is awkward anyhow, since it doesn't map to content attribute |
| 11:05 | <smaug____> | but I'm fine with the behavior what your patch gives |
| 11:13 | <smaug____> | and thanks :) |
| 11:13 | <smaug____> | makes reviewing a patch for Gecko easier. |
| 16:55 | <smaug____> | annevk: still one question :) "Whenever an element including HTMLOrSVGElement has its nonce attribute is set or changed, set this element's [[CryptographicNonce]] to the given value." What is supposed to happen when nonce attribute is removed? |
| 16:55 | <smaug____> | based on the spec, the nonce slot isn't modified |
| 16:55 | <smaug____> | that is somewhat surprising, but perhaps there is some reason for that |
| 17:02 | <annevk> | smaug____: i think that's to allow hiding it yourself |
| 17:02 | <annevk> | smaug____: maybe I should add another test for that though |
| 17:02 | <smaug____> | aha |
| 17:03 | <smaug____> | so if one wants to clear the value, setAttribute("nonce", "") is needed |
| 17:03 | <annevk> | smaug____: I think the main idea would be to use the IDL attribute |
| 17:03 | <smaug____> | well, idl + removeAttribute would work too |
| 17:05 | <annevk> | yeah, I guess if there's a good reason for further tweaks we could make them, but I feel like I already put more effort into this than I should ๐ |
| 17:12 | <smaug____> | sorry :) |
| 17:12 | <smaug____> | all of this behavior is just so super unusual |