26982 2014-10-06 09:49:33 +0000 1.9.1 , list before CSRF, first item 2016-04-25 18:44:25 +0000 1 1 1 Unclassified HTML WG HTML5 spec unspecified PC Linux RESOLVED FIXED P2 editorial --- 1 stefan dave.null arronei mike public-html-admin public-html-wg-issue-tracking public-html-bugzilla oldest_to_newest 112733 0 stefan 2014-10-06 09:49:33 +0000 Now: When allowing harmless-seeming elements like img, it is important to whitelist any provided attributes as well. Suggestion: When allowing harmless-seeming elements like img, it is important to whitelist only the necessary attributes (that are needed for this specific demand). Comment: provided ist an expression that can be used in any way. In this case, it could be misunderstood (maybe not only by non native english speakers). The point should be that only safe attributes should be whitelisted. 126106 1 arronei 2016-04-25 18:44:25 +0000 HTML5.1 Bugzilla Bug Triage: fixed per suggestion. https://github.com/w3c/html/pull/252 If this resolution is not satisfactory, please copy the relevant bug details/proposal into a new issue at the W3C HTML5 Issue tracker: https://github.com/w3c/html/issues/new where it will be re-triaged. Thanks!