Bug 39420 – REGRESSION: :visited pseudo class doesn't work for links with custom background

• Component: CSS
• Status: RESOLVED FIXED

[Steve]

as the title suggests, and my website is using the pseudo class to show which page you are on. it works fine within the latest version of safari it just doesn't seem to be in the latest webkit nightly

[Alexey Proskuryakov]

Could you please clarify what exactly doesn't work? I don't see any difference in look or behavior (other than different text antialiasing in top left box).

[Steve]

Created attachment 56636 [details]
a visited link

[Steve]

i've amended the title i put the wrong pseudo class, i meant the visited one, sorry for the confusion.

i've uploaded a picture to show, on each page of my website it has a unique body id and for that body id each page has a visited state for the navigation to show the user which page they are on. it doesn't show up webkit, maybe it's my coding but it works fine in safari

sorry again for the confusion hope this clears it up

[Alexey Proskuryakov]

Created attachment 56646 [details]
reduced test case (only works from a local file)

[Alexey Proskuryakov]

<rdar://problem/8011575>

[Dave Hyatt]

We no longer honor background images on visited links.  Firefox is also removing support for this capability.  Honoring background images on visited links allows for timing attacks that let your set of visited sites be snooped.

[Dave Hyatt]

http://dbaron.org/mozilla/visited-privacy has the details of the new algorithm used by both Firefox nightlies and WebKit nightlies.

[Dave Hyatt]

Specifically see the Risks section in that document.

[Dave Hyatt]

The fact that normal colors don't work is a bug though.  Let me look into it.

[Steve]

thanks for clearing this up, so i guess i'm better off removing the visited class. will there be something safer/similar implemented it's just on the side of usability for the user, not a huge issue, but it's a little helper?

[Steve]

read the article you suggested, so ignore my question.

[Dave Hyatt]

Created attachment 56679 [details]
Patch

[WebKit Review Bot]

Attachment 56679 [details] did not pass style-queue:

Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1
WebCore/ChangeLog:10:  Line contains tab character.  [whitespace/tab] [5]
Total errors found: 1 in 54 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Dave Hyatt]

Comment on attachment 56679 [details]
Patch

Nvm, I see a few typos.

[Dave Hyatt]

Created attachment 56680 [details]
Patch

[WebKit Review Bot]

Attachment 56679 [details] did not build on chromium:
Build output: http://webkit-commit-queue.appspot.com/results/2294417

[Dave Hyatt]

Created attachment 56681 [details]
New patch that should build on Chromium

[WebKit Review Bot]

Attachment 56680 [details] did not build on chromium:
Build output: http://webkit-commit-queue.appspot.com/results/2279412

[WebKit Review Bot]

Attachment 56681 [details] did not build on chromium:
Build output: http://webkit-commit-queue.appspot.com/results/2314379

[Dave Hyatt]

Created attachment 56685 [details]
Address Dan's comments from IRC and make more Chromium build fixes

[Alexey Proskuryakov]

> We no longer honor background images on visited links.

I'm curious whether the site should work anyway - it uses the same image for every state, but with offset and clipping.

[Steve]

it's css sprites, it works in all browsers - it saves for having to use javascript and such things and allows for better page load times and less requests made, it's a widely used technique from what i know.

[Dave Hyatt]

Pretty sure you're still vulnerable to timing attacks if you are willing to render different portions of the same image.  If the image can be repositioned, you can affect the rendering time by keeping it from painting using clips.

[Steve]

(In reply to comment #23)
> Pretty sure you're still vulnerable to timing attacks if you are willing to render different portions of the same image.  If the image can be repositioned, you can affect the rendering time by keeping it from painting using clips.

i never knew this existed so i'm glad i reported it and i'll be making some changes so i don't get caught out

[Dave Hyatt]

Fix landed in r59956.

[WebKit Review Bot]

http://trac.webkit.org/changeset/59956 might have broken Qt Linux Release
The following changes are on the blame list:
http://trac.webkit.org/changeset/59955
http://trac.webkit.org/changeset/59956