@bramus Very much in support of this! I can definitely...

@bramus Very much in support of this! I can definitely see uses for this.

Question: would this be usable for building URLs that for example use an attribute or a variable? (`background: url(ident("/files/icon/" attr(data-icon) ".svg#hue=" var(--hue, 0)))` (crappy example but I think you get the idea!)

I know it's been discussed in the past (perhaps with a new function? I don't recall), and I know that a URL is not an ident, but just feels like they share a similar goal of constructing strings.

Like 19 December at 0:24 | Wall-to-wall | Open on front-end.social

2 comments

Bramus

@chriskirknielsen This would not work because the function spits out idents, not strings.

And even if it could be converted into a string it would most likely not be allowed for privacy reasons.

(The redesigned attr() for example is rightfully prevented from being used in URLs, as one could steal user-data that way)

19 December at 0:48 | Open on front-end.social

Christopher Kirk-Nielsen

@bramus Figured as much, just looked like they could achieve a similar result (thought with a different output type), but the privacy and security reasons are definitely a concern. Has this data exfiltration issue basically killed all hopes of building dynamic URLs in CSS (if you know)? Which is understandable, but still a little sad.

19 December at 16:05 | Open on front-end.social