Missing destination types for some style initiated resources

[noamr]

Styles can lead to fetching color-profiles and SVG shapes. Which destination types should they use? Maybe they need new ones? (svg / color-profile)?

[annevk]

For color profiles I would expect a new destination, yes. Probably "colorprofile" given that it's also "sharedworker". I would also expect CORS and MIME type enforcement. Do you know if that is implemented/tested?

Is that all the documentation on SVG shapes? How are they fetched? Would we expect to support other images too? Are they implemented/tested?

[noamr]

For color profiles I would expect a new destination, yes. Probably "colorprofile" given that it's also "sharedworker". I would also expect CORS and MIME type enforcement. Do you know if that is implemented/tested?

Is that all the documentation on SVG shapes? How are they fetched? Would we expect to support other images too? Are they implemented/tested?

I'm starting to spec that stuff, but I started with the resources that already have a destionation type here.

SVG shapes are implemented, not sure about external color profiles.

[annevk]

I'm asking as from a high-level SVG shapes don't seem to be different from an image fetch. But maybe there's something I'm missing that warrants a different destination for them.

[annevk]

cc @whatwg/css

[noamr]

I'm asking as from a high-level SVG shapes don't seem to be different from an image fetch. But maybe there's something I'm missing that warrants a different destination for them.

Their internals are used, like a reference to an internal shape in the SVG. Maybe "image" is good enough for this.

CSS shape fetching is done with CORS, but I'm not sure if that's defined anywhere or just in implementation.

[dveditz]

CSS shape fetching is done with CORS, but I'm not sure if that's defined anywhere or just in implementation.

It had better be defined somewhere! This otherwise violates the same-origin policy.

CSS Shapes Module Level 1 (2014) was pretty specific about using CORS when using images:

User agents must use the potentially CORS-enabled fetch method defined by the [HTML5] specification for all URLs in a shape-outside value. When fetching, user agents must use "Anonymous" mode, set the referrer source to the stylesheet’s URL and set the origin to the URL of the containing document.
(from https://www.w3.org/TR/css-shapes-1/#shape-outside-property)

Level 2 doesn't mention CORS anywhere, not even for the old stuff.

[noamr]

CSS shape fetching is done with CORS, but I'm not sure if that's defined anywhere or just in implementation.

Level 2 doesn't mention CORS anywhere, not even for the old stuff.

I'm fixing that in this pull request.

[annevk]

If shapes are that old I guess they use "image" as destination today? If so I think that's fine.

Giving color profiles their own destination does seem reasonable though, even if CSP will group it with style.