Safari 5 Link selector: bug or security feature?

Safari 5 came out today. I am still testing. Safari 5 does not support all CSS selectors. While webkit (the engine behind Safari) has been supporting all CSS selectors, including all proposed CSS3 selectors for a long time now, today’s release does not support a:link and a:visited. There is a grid of CSS3 Selectors and Browser support at my other blog, Standardista.com.

I’ll be testing further over the next few days, but since this one is a doozy if it is a bug, and undocumented (my Google skills are failing me at this hour), i wanted to let y’all know now instead of waiting for my full post. Does anyone know if this is a new security feature, or if it is a bug?

You can download safari.

UPDATE:

According to a somewhat hidden security file at Apple, http://support.apple.com/kb/HT4196, this seems like it is actually a security feature:

WebKit: Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.2 or later, Mac OS X Server v10.6.2 or later, Windows 7, Vista, XP SP2 or later
Impact: A maliciously crafted website may be able to determine which sites a user has visited

Description: A design issue exists in WebKit’s handling of the CSS :visited pseudo-class. A maliciously crafted website may be able to determine which sites a user has visited. This update limits the ability of web pages to style pages based on whether links are visited.

At the time of this writing, it was at the way bottom of the page.

This entry was posted in Browsers, CSS (including hacks). Bookmark the permalink.

16 Responses to Safari 5 Link selector: bug or security feature?

  1. yosh says:

    Smells more like a bug, doesn’t it?

  2. Guest says:

    Maybe this has something to do with :visited security issue?
    http://dbaron.org/mozilla/visited-privacy

  3. oh fun & no, not much on google yet besides general forum complaints.

    looks like the :visited issue is more complicated & needs some test cases… the links in the content of my personal blog get flipped to black on black when visited and become unreadable. And I can’t seem to trace how or why with the inspector.

    also some other issues with some margins or positioning that I can’t seem to “inspect” to find the cause, but I’m just starting to dig into things.

  4. girlie_mac says:

    First, I thought of Mozilla’s security concern on visited link, but I have not seen that Apple’s statement on the issue.
    Also, according to Moz Hack, you can still visually style visited links, just limited (e.g. no alpha, or transparent for color values).
    http://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/

    Ha, maybe the most important URL you need is:
    http://bugreporter.apple.com

  5. Estelle Weyl says:

    From a twitter reply to me:

    Bug. :visited is useful UI in specific cases. The spec sounds like vendors have their choice. http://bit.ly/9TVZ4t

  6. Screwlewse says:

    Hey.. you didnt even credit me for the twitter reply. :D
    Yeah.. seems that it’s up to the vendor according to the CSS3 spec, however, why would they remove it? I guess it’s one less thing to support, but still.

  7. Estelle Weyl says:

    Hey @screwlewse:

    Figured if you wanted to be identified…..

    thanks for posting.

    @girlie_mac, thanks for posting too.

  8. Xavier says:

    I just see I have the same trouble. Why visited links are not working? it’s a bug?
    I was trying to resolve, but sincerely, I think my css are ok and it’s a bug from safari, no? this css are working well in all other browsers..
    I tryied changing color of the visited links and this works well but text-decoration does’nt work. what a headhache ; (

    if you find what’s going on, I will appreciate your solution,
    thank you!

  9. Estelle Weyl says:

    It seems to be a security feature, not a bug. I’ve updated to post to reflect that.

  10. Steve says:

    It’s definitely a security feature, I submitted it as a bug a few weeks ago while using webkit nightly and got a few responses explaining the matter as well as the article posted here: https://bugs.webkit.org/show_bug.cgi?id=39420

  11. Miguel says:

    I have the same problem. In my case, it uses the background-color value for a:visited but not the given height.
    And if I check the inspector, there’s no info of where the background-color value comes from. :-S

  12. Estelle Weyl says:

    Thanks for the link steve. According to the bug, the lack of support is partially a security feature. However, according to the bug content, the colors should still be a feature… and the fact that Safari 5 is not supporting color change for :visited versus :link is in fact a bug.

    According to the Mozilla privacy article, color, background-color, border-color, outline-color, column-rule-color, fill, and stroke should be supported.

  13. Hi Estelle,

    Visited links in Safari 5 work for me. I tested both this blog post and the Google Search results and the color of the links have changed.

    Using Safari Version 5.0 (6533.16) on Mac 10.6.3.

    -Jason

  14. Pingback: Things I Found Interesting Around June 18th | Chris Coyier

  15. Has anybody else been having problems with links randomly being displayed in the wrong color?

    In my CSS, I have a, a:link {color: #9eab11} which works fine, but then sometimes I’ll refresh a page and the link will be styled as if I had used color: inherit (which I haven’t). If I inspect the element, it shows that the link should be #9eab11, but it’s not for some reason.

    Am I the only one having this problem? I spent like an hour the other day trying to figure out why my links were the wrong color and then fixed it finally by refreshing.

  16. Frank says:

    What? They disabled the feature alltogether? Am I the only one that likes that the browser informs me what links I’ve visited so that I don’t have to waste my precious time to check it myself?

    I have known about that you can use the :visited selector for other things than just color for a very loong time. People that are that suspicious should hide in a cave – on mars.

    Check this: http://browserspy.dk/css-exploit.php

    @Andrew: I do not really know what you mean, but I know that on my mothers blog, in the tagcloud the colour tended to change right in the middle of a letter from green to pink… Even tought the element said it would be green.

    This happend at four diffrent computers, each using a difrent browser. On inspection all claimed that the text would be green…

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>