NEW 267613
::part() and pseudo-elements leak shadow DOM info with :is(), :where(), and :has() 
https://bugs.webkit.org/show_bug.cgi?id=267613
Summary ::part() and pseudo-elements leak shadow DOM info with :is(), :where(), and :...
Nathan Knowler
Reported 2024-01-16 16:01:09 PST
Created attachment 469424 [details] A demonstration of a few ways that :has() and :is() can leak shadow DOM info from CSS parts and pseudo-elements. It is currently possible to evaluate `:is()` and `:has()` selectors after `::part()` and some element-representing pseudo-elements (e.g. `::placeholder`). For example, all of the following selectors work: input::placeholder:is(div) { color: DeepPink; } site-header::part(list):has(li) { color: DeepPink; } site-header::part(list):is(nav > ul) { color: DeepPink; } site-header::part(list):is(primary-nav:state(--happening) ul) { color: DeepPink; }
Attachments
A demonstration of a few ways that :has() and :is() can leak shadow DOM info from CSS parts and pseudo-elements. (2.79 KB, text/html)
2024-01-16 16:01 PST, Nathan Knowler 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Nathan Knowler
Comment 1 2024-01-16 16:18:02 PST
Just clarifying that the `:state()` example requires Safari Tech Preview 185+ with the flag for CustomStateSet enabled.
Nathan Knowler
Comment 2 2024-01-16 16:44:29 PST
Related Chrome bug filed here: https://bugs.chromium.org/p/chromium/issues/detail?id=1519006
Nathan Knowler
Comment 3 2024-01-16 22:08:45 PST
:where() is affected as well (I’ll update the attachment when I get a chance).
Radar WebKit Bug Importer
Comment 4 2024-01-23 16:02:16 PST
<rdar://problem/121475919>
Note You need to log in before you can comment on or make changes to this bug.