From 9d4d9a8b80711322766900639a64d065c4f575de Mon Sep 17 00:00:00 2001 From: David Carlisle Date: Sat, 30 May 2026 14:04:31 +0100 Subject: [PATCH 1/2] update for #576 --- src/conformance.html | 120 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 116 insertions(+), 4 deletions(-) diff --git a/src/conformance.html b/src/conformance.html index 68b1779..8cbf114 100644 --- a/src/conformance.html +++ b/src/conformance.html @@ -316,16 +316,128 @@

Attributes for unspecified data

Privacy Considerations

-

Web platform implementations of MathML should implement [[MathML-Core]], - and so the Privacy Considerations specified there apply.

-
+

Web platform implementations of MathML should implement [[MathML-Core]], + and so the Privacy Considerations specified there apply in addition to the + considerations listed below.

+ +
+

intent

+

Authors must not use intent to + convey hidden instructions, behavioral probes, tracking tokens, or + content that materially differs from the visible mathematical + expression. intent should be used only to disambiguate or improve + narration/navigation of the same mathematical content.

+

User agents should not expose to page script any signal + indicating whether, how, or by whom intent was consumed by assistive + technology.

+ + +

The intent attribute provides an + author-supplied semantic layer intended to improve mathematical + narration and accessibility. Although intent does not directly expose user + data, its processing may depend on assistive-technology behavior, + locale, speech or braille settings, supported concept + dictionaries, fallback behavior, or parsing + outcomes. Implementations should ensure that these processing + differences are not exposed to page script. In particular, user + agents and assistive technologies should not expose generated + speech strings, parse errors, supported concept dictionaries, + fallback choices, or other AT-specific processing results through + DOM APIs, accessibility APIs observable by the page, events, + timing, layout, or other page-observable behavior.

+ +

Implementations should use document and element language as the + author-controlled input for intent interpretation when + possible. User-specific locale, speech, braille, or + assistive-technology preferences may affect the user’s final + accessibility experience, but differences derived from those + preferences must not be exposed to page script through generated + accessible names, fallback behavior, parsing errors, timing, + layout, events, or other observable behavior.

+ +
+ +
+

Content MathML

+

Content MathML semantic identifiers such as definitionURL, cd, and csymbol should be treated as opaque + identifiers in web contexts. User agents must not automatically + fetch, resolve, or dereference them during parsing, rendering, or + accessibility processing unless an application explicitly requests + such resolution subject to the host environment’s normal fetch and + privacy controls.

+
+

Security Considerations

Web platform implementations of MathML should implement [[MathML-Core]], - and so the Security Considerations specified there apply.

+ and so the Security Considerations specified there apply in addition to the + considerations listed below.

In some situations, MathML expressions can be parsed as XML. The security considerations of XML parsing apply then as explained in [[?RFC7303]].

+ + + + +
+

href

+

In web contexts, MathML href must not create link, + navigation, URL-scheme, referrer, script-execution, download, or + target-handling capabilities beyond those allowed by the host + environment’s ordinary link model. href + on non-rendered elements or nested within MathML links should not + generate links.

+
+ +
+

intent

+ + +

The intent attribute is author-controlled + input. Implementations may parse it according to the MathML intent + grammar, but any author-provided text derived from intent should + be treated as data when forwarded to speech, braille, + accessibility, or platform services. Such text should not be + interpreted as SSML, commands, markup, URLs, scripts, or other + control instructions unless explicitly defined and safely + constrained.

+ +
+ +
+

annotation

+ + +

In web contexts, external annotation references via annotation src + or annotation-xml src must not be fetched automatically + during parsing, rendering, accessibility-tree construction, or other + passive processing. Any processor that expands or exports external + annotation content should treat the reference as an explicit + resource load subject to the host environment’s normal fetch, CSP, + referrer, credentials, mixed-content, and network-isolation + policies.

+ +
+ +
+

mglyph

+

Web implementations and polyfills must treat mglyph resource loading like ordinary + image loading: subject to CSP, referrer policy, mixed-content + blocking, credential rules, and canvas tainting where + applicable. User agents should not create additional network + observability beyond ordinary image loading behavior.

+ +
+
+ From df41e682f6e0631d1c5904df910b4d569120ab39 Mon Sep 17 00:00:00 2001 From: David Carlisle Date: Sat, 30 May 2026 22:13:29 +0100 Subject: [PATCH 2/2] attribute markup --- src/conformance.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/conformance.html b/src/conformance.html index 8cbf114..aab3230 100644 --- a/src/conformance.html +++ b/src/conformance.html @@ -325,7 +325,7 @@

intent

Authors must not use intent to convey hidden instructions, behavioral probes, tracking tokens, or content that materially differs from the visible mathematical - expression. intent should be used only to disambiguate or improve + expression. intent should be used only to disambiguate or improve narration/navigation of the same mathematical content.

User agents should not expose to page script any signal