<p>TIL that CSS attr() cannot be used to compute anything in `url()` as the spec considers these to be “attr()-tainted” (for very valid security reasons): <a href="https://drafts.csswg.org/css-values-5/#attr-security" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">drafts.csswg.org/css-values-5/</span><span class="invisible">#attr-security</span></a></p><p>Thought maybe there was a way forward for global custom CSS-only favicons via new advancements in attr() <a href="https://developer.chrome.com/blog/advanced-attr" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">developer.chrome.com/blog/adva</span><span class="invisible">nced-attr</span></a> (but alas, no — which, in hindsight — seems valid and fair)</p>
- Post #720
- Next October 28, 2025 at 1:09:00 PM UTC
- Previous October 27, 2025 at 4:55:47 PM UTC
- Tue, 28 Oct 2025 13:08:20 GMT — Zach Leatherman
- Original on Fediverse