Compound Document by Reference Framework 1.0

1.5.1 Schemas in case of reference

In compound by reference, each document has its own schema based on its language. For example, referencing XHTML document has its own schema and referenced SVG has its own.

Each document is handled separately and schemas are validated based on language on each document separately. Therefore, in case of compound by reference, there are no additions to current schema handling.

1.5.2 Schemas in case of inclusion

In compound by inclusion, the compound document has a merged schema. Because multiple languages are used within the same document, there is a need for merged schema to allow document validation.

However, the Compound Document Framework 1.0 does not specify how schemas are combined in cases based on inclusion. This is left for future version of the Compound Document Framework.

1.6.1 User Agent Identification

For Compound Document profiles that define a unique profile name, compliant CDF user agents must advertise all supported profiles, using the "UA-Profiles:" header.

Example:

UA-Profiles: wicd, foocd

Any Compound Document profile specification is responsible for defining it's unique profile name, if it is required for that profile name to be advertised by the user agent.

A version number can be attached to a profile name. If no version number is provided, the agent can be expected to support version "1.0" of the named profile.

Example:

UA-Profiles: wicd:ver=1.1, foocd

An different version number refers, in general, to a complete new specification of the named profile. Whether a higher version number indicates a superset profile of a lower version number depends on the profile. If the profile specification document specifies this, then it is suggested for content providers, evaluating the version number, to accept a higher version number as a compliant implementation.

If no version number is provided, the agent can be expected to support version "1.0" of the named profile.

2.1.1 Specialized DOM access

Many languages define specialized DOM APIs. The W3C has defined an HTML DOM which extends the Core DOM and provides various convenience APIs for interacting with HTML documents. Similarly, the SVG language defines an SVG DOM which extends Core DOM.

Compound document profiles must specify whether the specialized DOM APIs that are defined within the component languages are supported.

Note: Although not required for compliance with the Compound Document Framework, it is strongly recommended that compound document profiles support all specialized DOM APIs that are supported in the component languages.

2.1.2 Child to Parent DOM Access

User agent must provide access to parent document.

For a child document to access the parent document, this specification introduces the ReferencedDocument interface.

The ReferencedDocument interface only applies to objects implementing the Document interface defined in DOM Level 3 Core. [DOM3Core] profiles build upon this specification must specify on which exact document objects the interface must be implemented. User agents may implement this interface for each document object they consider to be viable.

IDL Definition:

interface ReferencedDocument {
  readonly attribute Element referencingElement;
};

The referencingElement attribute must represent the element node used for including the current document in the parent document. If access to the parent document is disabled or there is no parent document the attribute must be null.

2.1.3 Parent to Child DOM Access

User agents must provide access to child documents.

DOM Level 2 HTML defined a way for several elements to access the child document using the contentDocument attribute. [DOM2HTML] This specification defines a generic ReferencingElement interface.

The ReferencingElement only applies to objects implementing the Element interface defined in DOM Level 3 Core. [DOM3Core] Profiles build upon this specification must specify on which exact element objects the interface must be implemented. User agents may implement this interface for each element object they consider to be viable.

IDL Definition:

interface ReferencingElement {
  readonly attribute Document contentDocument;
};

The contentDocument attribute must represent the child document. If access to the child document is disabled or there is no child document the attribute must be null.

2.1.4 SecurityException

Accessing parent or child documents through the DOM as described in sections 2.1.2 and 2.1.3 can be disabled for security reasons. In such cases user agents should throw a SecurityException.

IDL Definition:

exception SecurityException {
  unsigned short   code;
};
// SecurityExceptionCode
const unsigned short      SECURITY_ERR       = 83;

code represents an integer indicating the type of error generated. SECURITY_ERR is given back if an attempt was made to break through the security policy of the user agent.

2.1.5 Single-threaded access to compound document DOM

The framework assumes a single-threaded execution model for accessing the compound document's object model via the DOM. As a result, during the time when one script or event handler executes against the DOM, no other script or event handler can access the DOM.

NOTE: This does not preclude multiple execution threads, such as asynchronous downloading of image files or custom logic that operates on other (non-DOM) data structures. It simply precludes multiple scripts or handlers from operating on the DOM at the same time.

2.2.1 Event Propagation in a Compound Document

Events propagate from a child component up to it's parent.

There are four different cases how event flow through references can happen.

1. Object with external content <object src="file" />
2. Object with inlined content <object><content /></object>
3. Referenced image content <img src="file" /> (special case of 1)
4. Directly inlined content <content /> (special case of 2)

Compound Document Framework 1.0 provides a way to disable event propagation from one document to the another.

Each case should behave in a same way. There should not be any behavioural differences on how the content is referenced. However, there might be differences in default value if event propagation is enabled or disabled by default.

Event propagation is controlled by a DOM attribute named: 'events'

'events' attribute may have values 'block' or 'propagate'. The default value depends on referencing element.

'events' attribute applies to all referencing elements. Each referencing element must specify which is the default value.

In XHTML, the 'object' element is used to reference child document content whilst in SVG the 'foreignObject' element is used to reference child content. The default behaviour in existing user agents is to isolate events between a parent document and a referenced child document. The default value of the 'events' attribute is 'block'.

This attribute is used to control event propagation across referencing elements in a compound document.

Setting the 'events' attribute to 'block' causes a CDF compliant user agent to block event propagation at the parent/child boundary.

Setting the 'events' attribute to 'propagate' allows events in the compound document to cross the referencing boundary such that event capture and bubbling occurs between the parent and child document.

2.2.2 Security Event

Security event is a mechanism for notifying non-scripting related security violations.

Every time a document tries to break through security user agents should dispatch a security event in the http://www.w3.org/2005/10/cdf namespace on the document object. The event is not cancelable and has no bubbling phase. It implements the Event interface defined in DOM Level 3 Events. [DOM3Events]. Note, this is not the final namespace for this event.

For example, when an event is bubbling to other document that might violate security policy, user agent must prevent bubbling and dispatch a security event. User agents are responsible for making a security policy that identifies cases when event is dispatched.

2.2.3 Event-Related Legacy Markup

In order to claim conformance to this Compound Documents Framework, a compound document profile must define how all of its event-related language constructs and scripting constructs map to corresponding DOM3 event facilities, unless DOM3 events has already defined the mapping. In particular:

• For each event construct within supported languages, the profile must define the event's namespace and local name, what phases it supports (capture, target, bubble), whether it is cancellable, and the name of the DOM interface for its event structure (e.g., events.dom.w3c.org::UIEvent).

• Any events that are defined to be equivalent to a corresponding event from DOM3 Events must have compatible behavior, such as the phases supported, cancellability and propagation across parent/child compound document boundaries. For example, for a "click" event from language A to be equivalent to the DOM3 "click" event, it also must be cancellable since DOM3 "click" is cancellable.

• The profile must define how to map language features for event listeners, event handlers, and event targets into corresponding DOM3 Events facilities.

2.3.1 Child Documents

(This section is informative)

Since the child document's language specification defines hyperlinking behavior, here are recommendations for language specifications for languages which might be used as child documents within the context of compound documents:

If specifications provide a mechanism for hyperlinking they MUST also define a way to target specific frames. In addition it MUST be defined how the current document can be replaced (the document the link is defined in), the parent document and the root document.

Relevant language specifications should include a mechanism for defining the possible targets for the hyperlink. For example, the HTML4 specification includes a 'target' attribute on the 'html:a' element which supports targets of _blank, _self, _parent, _top and <frametarget> (see http://www.w3.org/TR/html401/types.html#type-frame-target). The SVG Tiny 1.2 specification also supports a 'target' attribute on the 'svg:a' element with the same list of possible values, except with the addition of an "_replace" keyword (see http://www.w3.org/TR/SVGMobile12/linking.html#AElementTargetAttribute). The WebCGM specification also supports targets of _blank, _self, _parent, _top, _replace and <frametarget> (see http://www.w3.org/TR/REC-WebCGM/REC-03-CGM-IC.html#webcgm_3_1_2_2).

NOTE: The keyword _self means different things in SVG than it does in HTML. In HTML it replaces the current document and in SVG it replaces the parent document.

Relevant language specification should provide a clear definition of the behavior of the "_self" keyword. For SVG and WebCGM, when there is a parent HTML document which references an SVG or WebCGM graphic via html:object, the "_self" keyword causes the HTML document to be replaced by the linked content. However, when a parent HTML document references a child HTML document via html:object or html:iframe, some HTML browsers implement the "_self" keyword such that only the child HTML document is replaced. Because of this, relevant language specifications should be clear about UA behavior in response to the "_self" keyword. One strategy to consider: if the primary usage scenario falls under the category of "replaced element" (see http://www.w3.org/TR/REC-CSS2/conform.html#replaced-element), as is the case with SVG, then defining "_self" to replace the parent document is appropriate.

For language specifications such as SVG which define "_self" to replace the parent document, it might be appropriate to support a "_replace" feature similar to what exists in SVG Tiny 1.2 and WebCGM. This feature causes a hyperlink to replace the child document only but leave parents and other ancestor documents unchanged. (For example, if an SVG document is referenced by a parent HTML document via an 'html:object' element, and if the SVG document has an 'svg:a' element with target="_replace", then when that hyperlink is activated, the SVG document gets replaced but there are no changes within the parent HTML document.)

Sometimes in industry practice a plugin user agent is used to handle certain types of child documents. For example, plugins might handle SVG or MathML child documents. In these scenarios the plugin may only be able to handle particular formats via the "_replace" keyword. (For example, a MathML plugin might be able to handle only MathML content.) Because of this, relevant language specification that support "_replace" (or alternative syntax for the same feature) should clearly specify requirements when "_replace" references content of the same type and content of other types. (For example, only content of the same type can be referenced with "_replace", or any type can be referenced with "_replace", but then error processing must be defined for unknown or unsupported content.)

2.3.2 Parent Documents

(This section is informative)

One potential area of ambiguity in the context of compound document is the meaning of the "_self" and "_parent" keywords. (See HTML4's definition at http://www.w3.org/TR/html401/types.html#type-frame-target and SVG Tiny 1.2's definition at http://www.w3.org/TR/SVGMobile12/linking.html#AElementTargetAttribute). For example, suppose a parent XHTML document references a child SVG document via an 'html:object' element and suppose the SVG document has an 'svg:a' element with target="_self". The SVG Tiny 1.2 specification says that "_self" causes both the XHTML parent frame and the child SVG to be replaced when the hyperlink is activated.

However, there are potential ambiguities if the parent language format supports its own particular notions of nested regions (e.g., frames, panes or sub-documents). It is strongly recommended that relevant language specifications clearly define how its own nested region features relate to the hyperlinking keywords _self, _parent, and _top.

2.4.1 Referencing elements

(This section is informative)

In Compound Document Framework 1.0, embedding media and other objects is done by using the existing elements in the host languages rather than by extending them with new markup. In XHTML documents, the <object> element will be used to reference XML document types. In SVG documents, the <foreignObject> element is used. In SMIL, the ref element should be used.

2.4.2 Declarative Child Object Parameters

(This section is informative)

It may be necessary to transfer parameters declaratively to a referenced child object. Compound Document profiles may define specific parameters/values for this purpose. Two examples:

<object type="..." data="...">
  <param name="param1" value="true" />
  <param name="param2" value="123" />
</object>

<svg xmlns="http://www.w3.org/2000/svg">
    <foreignObject>
        <metadata>
           param=value;
           param=value
        </metadata>
    </foreignObject>
</svg>

2.5.1 Phishing

(This section is informative)

A common security problem on the Web is known as "phishing". A web application that looks like one which is trusted by the user collects some data (for example credit card numbers, addresses, etc), and then posts that information to a potentially hostile third party.

Allowing access across document boundaries potentially allows an object to fetch the actual document which is trusted by the user, and read the user's data as it is entered. This approach could defeat many browser interface features which are designed to warn the user that a site is not the one they think.

2.5.2 Firewall attack

(This section is informative)

Another common attack is to post a document to a user behind a firewall, and then use it to gain access to a server whose name is known but which is normally behind the firewall, and then post information from the retrieved resources to a hostile party.

2.5.3 How this is handled today?

(This section is informative)

Currently, the common approach used is to restrict access across documents or network interfaces to material which comes from the same source as the code which tries to make that access. This makes it difficult to re-use resources on the Web, by requiring a copy to be held in the domain of each application which uses that resource. This breaks cacheability, potentially reduces maintainability, and requires services to maintain the entire service rather than taking full advantage of specialised third-party providers.

There are several possible approaches to a security model which is less restrictive. Cross Document Messaging [1] is one such.