Re: Custom-elements: document.registerPolyfillElement ?

2014-06-10 Thread Dominic Cooney
On Mon, Jun 9, 2014 at 4:00 PM, Brett Zamir bret...@gmail.com wrote: I was looking to make a genuine polyfill for dialog (not just a shim), and I found Polymer's CustomElements helpful, but realized too late that the spec required x- prefixes. I still feel like it would be useful to have a

Re: Blob URL Origin

2014-06-10 Thread Anne van Kesteren
On Tue, Jun 10, 2014 at 12:16 AM, Arun Ranganathan a...@mozilla.com wrote: Right now, the Blob URL Store is defined in terms of units of similar-origin browsing contexts; each unit is required to have a Blob URL Store. As you point out, that allows all origins within document.domain access to

Re: HTML imports: new XSS hole?

2014-06-10 Thread Frederik Braun
On 04.06.2014 11:00, Anne van Kesteren wrote: On Tue, Jun 3, 2014 at 7:20 PM, Oda, Terri terri@intel.com wrote: Perhaps it would make sense to also require explicit allowing of imports via CSP? Scripts are allowed when no CSP is provided for historical compatibility so you'd need to make

Re: HTML imports: new XSS hole?

2014-06-10 Thread Anne van Kesteren
On Tue, Jun 10, 2014 at 10:36 AM, Frederik Braun fbr...@mozilla.com wrote: Were you saying script import=url/script or script src=url import/script? The former. The latter is reserved for loading and executing scripts. I, by the way, wholeheartedly agree that link tags become more dangerous

Re: IE - Security error with new Worker(URL.createObjectURL(new Blob([workerjs],{type:'text/javascript'})))

2014-06-10 Thread Aymeric Vitte
Thanks, any way to track/be notified when this will be available? Regards Aymeric Le 06/06/2014 19:42, Travis Leithead a écrit : Well, in IE's defense, this is not specifically allowed by: http://www.w3.org/TR/workers/#dom-worker. Regardless, the product team is working to fix this so that

Re: [webcomponents]: Telcon on as-needed basis from now on

2014-06-10 Thread Arthur Barstow
On 6/9/14 12:09 PM, Dimitri Glazkov wrote: I think it might be best to flip the regular bit to off for now, and only use this time slot when we have other participants. Thus, consider the weekly call cancelled unless there's an announcement otherwise. That sounds like a good plan Dimitri.

Re: Custom-elements: document.registerPolyfillElement ?

2014-06-10 Thread Brett Zamir
Thanks, this is helpful to know, though I'd still prefer a solution at some point which didn't require one to use extra code and once the polyfill was no longer needed, requiring alteration of code to be semantically correct (e.g., if it no longer is a x-polyfill-dialog because the

RE: IE - Security error with new Worker(URL.createObjectURL(new Blob([workerjs],{type:'text/javascript'})))

2014-06-10 Thread Travis Leithead
Unfortunately, there is not presently a way for you to track it externally. :-( MS Connect is the best we have so far, and I know that it is not great. We recognize this is a problem and hope to be able to improve the situation soon. -Original Message- From: Aymeric Vitte

[Bug 26033] New: Make distribution algorithm forward compatible with shadow as function call.

2014-06-10 Thread bugzilla
https://www.w3.org/Bugs/Public/show_bug.cgi?id=26033 Bug ID: 26033 Summary: Make distribution algorithm forward compatible with shadow as function call. Product: WebAppsWG Version: unspecified Hardware: PC