[Webkit-unassigned] [Bug 124128] [regression] foreign content not displayed in MathML

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=124128


David Carlisle <davidc at nag.co.uk> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |davidc at nag.co.uk




--- Comment #13 from David Carlisle <davidc at nag.co.uk>  2014-01-09 11:47:49 PST ---
The HTML5 (In reply to comment #9)
> Mixing arbitrary markup with MathML was introducing a case where non-MathML nodes were being interpreted as MathML. This could pose a security risk.
> 

The HTML5 spec is explicit that this should be allowed. Phrasing content is allowed in the token elements mo, mn, ms, mi, mtext and annotation-xml if it has encoding attribute text/html or application/xhtml+xml.



http://www.w3.org/html/wg/drafts/html/CR/syntax.html#parsing

(or the equivalent in the whatwg version)


A node is a MathML text integration point if it is one of the following elements:

    An mi element in the MathML namespace
    An mo element in the MathML namespace
    An mn element in the MathML namespace
    An ms element in the MathML namespace
    An mtext element in the MathML namespace

exactly what that implies is scatted through the parser state description but basically it means html is allowed there.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.