12:59:06 <RRSAgent> RRSAgent has joined #svg
12:59:06 <RRSAgent> logging to http://www.w3.org/2014/06/05-svg-irc
12:59:08 <trackbot> RRSAgent, make logs public
12:59:08 <Zakim> Zakim has joined #svg
12:59:10 <trackbot> Zakim, this will be GA_SVGWG
12:59:10 <Zakim> ok, trackbot, I see GA_SVGWG()9:00AM already started
12:59:11 <trackbot> Meeting: SVG Working Group Teleconference
12:59:11 <trackbot> Date: 05 June 2014
12:59:36 <Zakim> +BHill
12:59:39 <heycam> Zakim, who is on the call?
12:59:39 <Zakim> On the phone I see [IPcaller], BHill
12:59:53 <Zakim> +Rich_Schwerdtfeger
13:00:04 <Zakim> +[IPcaller.a]
13:00:10 <cabanier> zakim, [ipcaller] is me
13:00:10 <Zakim> +cabanier; got it
13:00:15 <ed> Zakim, [IP is me
13:00:15 <Zakim> +ed; got it
13:00:34 <Zakim> +terri
13:00:50 <ed> Agenda: http://lists.w3.org/Archives/Public/www-svg/2014Jun/0005.html
13:01:18 <Zakim> +??P20
13:01:39 <mkwst__> Zakim, ??P20 is mkwst__.
13:01:39 <Zakim> +mkwst__; got it
13:01:43 <Zakim> +[IPcaller]
13:01:45 <heycam> Zakim, [ is me
13:01:45 <Zakim> +heycam; got it
13:02:05 <Zakim> +??P24
13:02:09 <Zakim> +??P21
13:02:14 <Zakim> +krit
13:02:20 <stakagi> zakim, ??P24 is me
13:02:20 <Zakim> +stakagi; got it
13:02:33 <nikos_> zakim, ??P21 is me
13:02:33 <Zakim> +nikos_; got it
13:03:04 <ed> Zakim, pick a scribe
13:03:04 <Zakim> Not knowing who is chairing or who scribed recently, I propose mkwst__
13:03:53 <Zakim> +Doug_Schepers
13:03:58 <ed> Zakim, pick a scribe
13:03:58 <Zakim> Not knowing who is chairing or who scribed recently, I propose Rich_Schwerdtfeger
13:04:13 <richardschwerdtfeger> scribe: Rich
13:04:36 <nikos_> scribenick: richardschwerdtfeger
13:04:37 <richardschwerdtfeger> Topic: How SVG and CSP can play nicely together.
13:04:54 <Zakim> +Tav
13:05:29 <richardschwerdtfeger> mkwst: SVG poses an interesting set of questions
13:05:53 <richardschwerdtfeger> mkwst: generally speaking security policy is devided into a number of directives
13:06:53 <richardschwerdtfeger> mkwst: these directives control resource types where SVG falls into the cracks
13:07:02 <richardschwerdtfeger> mkwst: may be loaded as an image
13:07:17 <richardschwerdtfeger> mkwst: an SVG document can load other images
13:07:40 <richardschwerdtfeger> mkwst: if example.com loads an SVG image what should we do with the resources loaded with that image
13:08:05 <richardschwerdtfeger> ed: Do you want an answer now to your questions?
13:08:13 <ed> s/ed/krit/
13:08:20 <richardschwerdtfeger> mkwst: it would be awesome but I don’t expect them.
13:08:37 <richardschwerdtfeger> mkwst: Does the group have questions about common security policy?
13:08:58 <richardschwerdtfeger> mkwst: since you are having a meeting I thought I would crash it to start the discussion
13:09:20 <richardschwerdtfeger> krit: in the case of loading an image we don’t load any resources in SVG.
13:09:29 <richardschwerdtfeger> krit: an SVG image has its own content
13:10:01 <shepazu> q+
13:10:04 <richardschwerdtfeger> mkwst: so one additional publication. SVG has the ability to control inline style and script
13:10:07 <krit> s/ its own content/ its own context/
13:10:51 <richardschwerdtfeger> mkwst: if  pushes .. down into an SVG document what are the implications?
13:10:58 <richardschwerdtfeger> mkwst: then there are IFrames
13:11:09 <richardschwerdtfeger> krit: IFrames are a different discussion
13:11:34 <richardschwerdtfeger> mkwst: Authors needs to limit the SVG document
13:11:47 <bhill2> q+
13:11:53 <richardschwerdtfeger> mkwst: are there features that are not covered by the current set of directives.
13:12:12 <richardschwerdtfeger> shepazu: so there are a couple of things. Are you aware of the <use> element
13:12:26 <richardschwerdtfeger> shapazu: use allows you to clone an element in line
13:13:02 <richardschwerdtfeger> shapazue: say you have a circle and a rectangle. define that once. Then you can use that element throughout the document in that it clones the element.
13:13:33 <richardschwerdtfeger> shepazu: SVG allows you to use an external resource
13:13:51 <richardschwerdtfeger> shepazu: people have called this a security issue
13:14:08 <richardschwerdtfeger> shepazu: The element being used could include script
13:14:31 <richardschwerdtfeger> shepazu: say a have a person icon in document 2
13:14:40 <richardschwerdtfeger> shepazu: the person icon could have script
13:15:02 <richardschwerdtfeger> shepazu: in any case the use element would allow you to use static images.
13:15:49 <richardschwerdtfeger> krit: For the use element within a document, there is no policy yet,
13:16:11 <richardschwerdtfeger> krit: We don’t define restrictions as of yet.
13:17:13 <shepazu> q+
13:17:13 <richardschwerdtfeger> mkwt: it looks like from the integration spec draft you can reference external documents. Can we shoehorn this into image.
13:17:36 <ed> s/mkwt/bhill/
13:17:41 <richardschwerdtfeger> krit: we should restrict with CSP
13:18:05 <richardschwerdtfeger> shepazu: we should be true to the same. We might run into an exception but I don’t anticipate doing so
13:18:25 <richardschwerdtfeger> shepazu: what is the security issue with inline styles and is this applicable to any CSS or other CSS properties?
13:18:44 <richardschwerdtfeger> bhill: We would inject CSS that could infiltrate data about the web site
13:19:06 <richardschwerdtfeger> bhill: we could determine whether content was on the page and ping that to an external server
13:19:19 <richardschwerdtfeger> krit: for images we don’t allow any requests
13:19:28 <bhill2> s/bhill/mkwst
13:19:48 <richardschwerdtfeger> shepazu: this is about fetching external resources across domain
13:20:03 <richardschwerdtfeger> mkwst: fetches is a vehicle for exfiltration
13:20:24 <richardschwerdtfeger> mkwst: the way that a page is constructed is certainly useful to a hacker
13:20:50 <richardschwerdtfeger> krit: What is the pattern for using selctors to get …
13:21:24 <richardschwerdtfeger> mkwst: if you can inject HTML into the page you can  use CSS to make it look like part of the page and direct you to another page. This would make phishing easier
13:21:57 <richardschwerdtfeger> krit: fill, stroke, are properties. So setting these on an SVG image is not a problem.
13:22:38 <richardschwerdtfeger> shepazu: we have things called presentation attributes. If I can say fill blue in CSS I can also say fill as an attribute (fill=“blue”) on the element. It roughly has the same effect.
13:23:18 <richardschwerdtfeger> shepazu: so, in that sense SVG does not need CSS to do inline styles. People would need to manipulate the DOM to provide these CSS attributes
13:23:35 <richardschwerdtfeger> shepazu: when they get to the point to change the DOM this is an issue
13:24:02 <richardschwerdtfeger> shepazu: you can use presentation attributes vs. presenation attributes. I don’t see this is an issue.
13:24:33 <richardschwerdtfeger> shepazu: I am saying that if the style element disabled you could use presentation attributes vs. CSS properties
13:24:55 <richardschwerdtfeger> bhill: isn’t it hard to avoid to inject content?
13:25:19 <richardschwerdtfeger> bhill: the thing is you can use selective loading into the document to exfiltrate data out.
13:26:04 <richardschwerdtfeger> cam: you want to inject content into the style attribute of the element which is more like than injecting content in where you can make any changes you want
13:26:53 <richardschwerdtfeger> mkwst: you can use CSS to modify the look with out content injection.
13:27:27 <richardschwerdtfeger> cam: a hacker can change the style on a given element using an external style sheet.
13:27:32 <richardschwerdtfeger> mkwst: yes
13:27:48 <richardschwerdtfeger> mkwst: you can inject a link element.
13:28:04 <bhill2> s/mkwst/bhill
13:28:09 <richardschwerdtfeger> krit: were you asking for the general use case of SVG or SVG as image?
13:28:21 <richardschwerdtfeger> cam: I want to know what that CSP keyword does.
13:29:00 <richardschwerdtfeger> krit: it is a complex topic. we svg as a root document, and image, with an iframe. so we have a number of issues
13:29:14 <richardschwerdtfeger> krit: you can have an image tag in html content
13:29:25 <richardschwerdtfeger> krit: a lot of the content created with SVG uses inline style
13:30:02 <richardschwerdtfeger> krit: I don’t think that disabling style on SVG images is going to work
13:30:51 <richardschwerdtfeger> mdwst: what I would like to evaluate is the risk that SVG images create. They need to not have access to the content they are embedded and cannot pull in resources.
13:31:00 <richardschwerdtfeger> s/mdwst/mkwst/
13:31:26 <richardschwerdtfeger> mkwst: we just need to verify that those 2 are always the case and and if so I am not particularly worried
13:31:32 <richardschwerdtfeger> krit: that is the case
13:31:41 <richardschwerdtfeger> cam: we need to put this information in
13:32:15 <ed> s/in/in (into the SVG Integration spec)
13:32:29 <richardschwerdtfeger> mkwst: what are the capabilties of SVG when loaded into an ifrrame or an iframe of that same origin. A content security policy needs to be delivered in these cases
13:32:50 <richardschwerdtfeger> mkwst: a security policy must be in place to cover all the things SVG can do.
13:33:08 <terri> http://www.w3.org/TR/CSP/#directives
13:33:21 <krit> https://svgwg.org/specs/integration/
13:33:51 <richardschwerdtfeger> mkwst: the common security spec. mentions little about  SVG as I know little about it
13:34:03 <mkwst__> https://w3c.github.io/webappsec/specs/content-security-policy/#sec-directives <-- Editor's draft of CSP 1.1 is a more up-to-date resource.
13:34:11 <richardschwerdtfeger> krit: should there a difference with id, object, or embed?
13:34:25 <richardschwerdtfeger> mkwst: I don’t know. What are the differences that are relevant?
13:34:26 <krit> s/id/iframe/
13:34:33 <richardschwerdtfeger> cam: we don’t know
13:34:52 <richardschwerdtfeger> cam: the difference with how the document is treated is some sizing.
13:35:51 <richardschwerdtfeger> mkwst: different directives will dictate will dictated by the resource
13:36:28 <richardschwerdtfeger> cam: gradient, use elements, we say the external document is loaded as a resource document. In the future we will say that these disable script
13:37:16 <richardschwerdtfeger> cam: should individual elements refrence things or the whole effort we have a policy regarding loading resources
13:37:54 <richardschwerdtfeger> shepazu and chris: we thing we should apply to the whole SVG spec. not individual elements
13:38:09 <ed> s/chris/krit
13:38:56 <shepazu> q+
13:39:10 <richardschwerdtfeger> krit: for resources documents we had the same policy as images
13:39:22 <richardschwerdtfeger> krit: some don’t support resources at all
13:39:39 <richardschwerdtfeger> cam: the resource document can’t load scripts or have external resources at all
13:40:04 <richardschwerdtfeger> shepazu: there are 2 different ways of style. One involves CSS and the other makes use of attributes
13:40:15 <krit> Zakim, help
13:40:15 <Zakim> Please refer to http://www.w3.org/2001/12/zakim-irc-bot for more detailed help.
13:40:18 <Zakim> Some of the commands I know are:
13:40:18 <Zakim>  xxx is yyy       - establish yyy as the name of unknown party xxx
13:40:18 <Zakim>                     if yyy is 'me' or 'I', your nick is substituted
13:40:18 <Zakim>  xxx may be yyy   - establish yyy as possibly the name of unknown party xxx
13:40:19 <Zakim>  I am xxx         - establish your nick as the name of unknown party xxx
13:40:19 <Zakim>  xxx holds yyy [, zzz ...] - establish xxx as a group name and yyy, etc. as participants within that group
13:40:19 <Zakim>  xxx also holds yyy - add yyy to the list of participants in group xxx
13:40:19 <Zakim>  who's here?      - lists the participants on the phone
13:40:20 <Zakim>  who's muted?     - lists the participants who are muted
13:40:20 <Zakim>  mute xxx         - mutes party xxx (like pressing 61#)
13:40:20 <Zakim>  unmute xxx       - reverses the effect of "mute" and of 61#
13:40:20 <Zakim>  is xxx here?     - reports whether a party named like xxx is present
13:40:20 <Zakim>  list conferences - reports the active conferences
13:40:21 <Zakim>  this is xxx      - associates this channel with conference xxx
13:40:21 <Zakim>  excuse us        - disconnects from the irc channel
13:40:21 <Zakim> I last learned something new on $Date: 2013-03-03 19:18:47 $
13:41:01 <richardschwerdtfeger> shepazu: unlike CSS which has selectors which can change an element. I don’t see how there can be a security issue with attribute based styling as they don’t have selectors.
13:42:06 <richardschwerdtfeger> shepazu: another nuance of the use element is that if I have 2 SVGs injected into and HTML document. SVG 1 can use a resource from SVG2. If Ihave an icon and I inject both SVGs into the page. I can use an icon from SVG2 into SVG1
13:42:28 <richardschwerdtfeger> shepazu: I don’t have to use the same origin. Those resource might have actual different origins
13:42:37 <richardschwerdtfeger> krit: so it is like one document
13:42:42 <richardschwerdtfeger> shepazu: yes
13:43:04 <richardschwerdtfeger> mkwt: We problaby need an unsafe inline directive for and SVG inline into the page
13:43:10 <richardschwerdtfeger> krit: why image?
13:43:34 <richardschwerdtfeger> mkwt: the other option is that we control it via script given that SVG can control it via script.
13:43:55 <richardschwerdtfeger> shepazu: it is markup not script
13:44:50 <richardschwerdtfeger> cam: I think if your page allows inline SVG somehow the hacker brings in script the script could control the page
13:45:19 <richardschwerdtfeger> mkwt: the hacker could inject SVG where the author was not expecting
13:45:43 <richardschwerdtfeger> terri: a lot of people have broken content filters
13:46:04 <richardschwerdtfeger> cam: people are checking for HTML and are not really looking at SVG which can use script
13:46:29 <richardschwerdtfeger> mkwt: it is easy to inject say a pornographic image
13:46:41 <richardschwerdtfeger> shepazu: how much of this is security vs. defacement
13:47:18 <richardschwerdtfeger> mkwt: this is for protection against defacement as well as script injection. The overarching control is to put hands into the site author so that they are not surprised.
13:47:31 <richardschwerdtfeger> shepazu: I need to talk to you about annotation
13:48:09 <richardschwerdtfeger> shepazu: we certainly have focused on a number of issues around SVG
13:48:52 <richardschwerdtfeger> shepazu: I wrote the SVG integration spec. but I did so without a reallistic view of security.
13:49:15 <richardschwerdtfeger> krit: we more or less address issues but have not made major changes for security
13:49:33 <richardschwerdtfeger> krit: please review the spec and identify issues.
13:49:53 <richardschwerdtfeger> shepazu: don’t take the spec. as reflective of our opinions or how browsers work currently
13:50:12 <richardschwerdtfeger> shepazu: Having you guys review SVG integration would help us in setting our goals
13:50:30 <richardschwerdtfeger> mkwst: that sounds reasonable. Going forward we should start conversations on the mailing list
13:50:53 <richardschwerdtfeger> ed: On the wiki we should list all the issues that are found. it is easy to get lost in the mail
13:51:19 <richardschwerdtfeger> shepazu: should we do this on the general W3C wiki?
13:51:51 <richardschwerdtfeger> Action: Doug start a page on the general W3C wiki on security
13:51:51 <trackbot> Created ACTION-3629 - Start a page on the general w3c wiki on security [on Doug Schepers - due 2014-06-12].
13:52:17 <richardschwerdtfeger> ed: most of the discussion should be on the mailing list
13:52:27 <richardschwerdtfeger> cam: it would be good to ask concrete questions
13:52:49 <richardschwerdtfeger> cam: if you have questions  … does this CSP directive effect SVG?
13:53:33 <richardschwerdtfeger> mkwst: we are not on www-svg
13:53:54 <richardschwerdtfeger> shepazu: are we talking about this in the context of 1.1?
13:54:01 <richardschwerdtfeger> mkwst: 1.1
13:54:08 <shepazu> https://www.w3.org/wiki/SVG_Security
13:54:33 <Zakim> -BHill
13:54:50 <richardschwerdtfeger> Topic: Resolving the Face to Face Dates for London
13:54:53 <Zakim> -mkwst__
13:55:00 <Zakim> -terri
13:55:19 <mkwst__> Thanks folks, looking forward to future cooperation. :)
13:55:28 <richardschwerdtfeger> cam: we talked about hte dates for London. I will book that in the London office. We did resolve meeting just before graphical web.
13:55:42 <terri> Thanks, that was really interesting from a security perspective!
13:55:45 <Zakim> -Tav
13:55:54 <heycam> http://www.w3.org/mid/538BBE1F.3040805@mcc.id.au
13:55:55 <terri> terri has left #svg
13:55:57 <richardschwerdtfeger> cam: given that graphical web is on a Wednesday.
13:56:14 <Zakim> -krit
13:56:16 <richardschwerdtfeger> cam: one was to make Th, Fr, Mo, Tues.
13:56:25 <shepazu> q+
13:56:26 <Zakim> +Tav
13:56:43 <richardschwerdtfeger> krit: I would prefer starting on Friday
13:56:48 <Zakim> +krit
13:56:57 <richardschwerdtfeger> shepazu: starting friday and going saturday and sunday
13:57:02 <ed> s/krit/ed
13:57:24 <krit> cabanier: and krit: would prefer Friday either
13:57:27 <richardschwerdtfeger> cam: I am not sure everyone is going to the graphical web
13:58:38 <richardschwerdtfeger> cam: could do the action editing on Saturday
13:59:02 <krit> Zakim, who is on the call?
13:59:04 <Zakim> On the phone I see cabanier, Rich_Schwerdtfeger, ed, heycam, stakagi, nikos_, Doug_Schepers, Tav, krit
13:59:19 <richardschwerdtfeger> RRSAgent, make log public
13:59:43 <richardschwerdtfeger> shepazu: are you going to suggest places to stay or are we on our own?
13:59:48 <richardschwerdtfeger> cam: good question
13:59:57 <richardschwerdtfeger> cam: I can look into special rates
14:00:20 <richardschwerdtfeger> RESOLUTION: London Face to Face: Friday, Saturday, Sunday
14:00:26 <glenn> glenn has joined #svg
14:01:00 <shepazu> q+
14:01:14 <richardschwerdtfeger> ed: Sydney face to face host by Google?
14:01:40 <richardschwerdtfeger> shepazu: webplatform.org is a documentation site
14:01:40 <ed> all: sounds good
14:01:59 <ed> ed: will tell Shane to go ahead with the planning
14:02:01 <richardschwerdtfeger> shepazu: we want the SVG documentation really good for this summer
14:02:26 <richardschwerdtfeger> RESOLUTION: Google hosts Syndy face to face jan/feb
14:02:49 <richardschwerdtfeger> s/Syndy/Sydney/
14:02:53 <ed> ACTION: ed to add a wikipage for Sydney F2F (early 2015) - hosted by google, co-located with csswg
14:02:53 <trackbot> Created ACTION-3630 - Add a wikipage for sydney f2f (early 2015) - hosted by google, co-located with csswg [on Erik Dahlström - due 2014-06-12].
14:03:15 <richardschwerdtfeger> shepazu: would anyone want to hang around for a documentation day after graphical web?
14:03:26 <richardschwerdtfeger> shepazu: this would be in London.
14:03:38 <Zakim> -heycam
14:03:40 <richardschwerdtfeger> shepazu: I will take some vacation time after graphical web.
14:04:14 <heycam> I will update the group soon with the London F2F meeting details.
14:04:20 <richardschwerdtfeger> shepazu: I am not sure people involved with graphical web would be interested in documentation
14:04:39 <richardschwerdtfeger> ed: please update the wiki page for the London F2F
14:04:48 <richardschwerdtfeger> shepazu: will do
14:05:01 <richardschwerdtfeger> zakim, bye
14:05:01 <Zakim> leaving.  As of this point the attendees were BHill, Rich_Schwerdtfeger, cabanier, ed, terri, mkwst__, [IPcaller], heycam, krit, stakagi, nikos_, Doug_Schepers, Tav
14:05:01 <Zakim> Zakim has left #svg
14:05:06 <richardschwerdtfeger> RRSAgent, make minutes
14:05:06 <RRSAgent> I have made the request to generate http://www.w3.org/2014/06/05-svg-minutes.html richardschwerdtfeger