TIL that CSS attr() cannot be used to compute anything in url() as the spec considers these to be “attr()-tainted” (for very valid security reasons): https://drafts.csswg.org/css-values-5/#attr-security
- Post #721
- Next October 28, 2025 at 1:11:00 PM UTC
- Previous October 28, 2025 at 1:08:20 PM UTC
- Tue, 28 Oct 2025 13:09:00 GMT — @zachleat.com - Zach Leatherman
- Original on Bluesky