Filed by the authors as an open question, not a bug report.
The rule as it stands
Third-party regions are inferred from structured markup such as itemprop="review", from class/id tokens indicating submission areas, and from embedded elements.
This is inference. When uncertain, fall back to first_party.
The fallback is deliberate: third_party carries the higher severity, so erring toward first_party is erring toward not accusing anyone.
The problem
The token lists that implementations end up using are English-shaped. review, comment, ugc, user-content, testimonial. The reference implementation adds a few Japanese operator markers (編集部, 運営, スタッフ) but the third-party side is almost entirely English.
That has a consequence worth stating plainly: on a site whose markup is authored in a language we do not enumerate, nearly everything infers to first_party. Injections planted by third parties there are systematically under-reported — not detected as warn instead of high, but attributed to the site operator, who did not put them there.
Under-reporting is the safe direction for false positives and the wrong direction for fairness to the operator.
The open question
- Which markers are missing? Concretely — what class and id conventions do comment and review systems use in your language and in your CMS?
- Is there a structural signal that generalises better than token lists?
itemprop="review", microformats h-entry, ARIA roles, <article> nested under a comments container — all are language-independent, and all are inconsistently used in practice.
- Should the definition say that region inference is only reliable for enumerated markup conventions, and report
region: undetermined otherwise — rather than silently defaulting to first_party?
Option 3 has the same shape as the existing treatment of unresolvable external CSS: say what you could not determine, instead of resolving it quietly to the convenient answer.
What would help most
Pull requests or comments listing real class/id conventions from comment and review systems, especially non-English ones. This is exactly the kind of knowledge a single author cannot have.
Filed by the authors as an open question, not a bug report.
The rule as it stands
The fallback is deliberate:
third_partycarries the higher severity, so erring towardfirst_partyis erring toward not accusing anyone.The problem
The token lists that implementations end up using are English-shaped.
review,comment,ugc,user-content,testimonial. The reference implementation adds a few Japanese operator markers (編集部,運営,スタッフ) but the third-party side is almost entirely English.That has a consequence worth stating plainly: on a site whose markup is authored in a language we do not enumerate, nearly everything infers to
first_party. Injections planted by third parties there are systematically under-reported — not detected aswarninstead ofhigh, but attributed to the site operator, who did not put them there.Under-reporting is the safe direction for false positives and the wrong direction for fairness to the operator.
The open question
itemprop="review", microformatsh-entry, ARIA roles,<article>nested under a comments container — all are language-independent, and all are inconsistently used in practice.region: undeterminedotherwise — rather than silently defaulting tofirst_party?Option 3 has the same shape as the existing treatment of unresolvable external CSS: say what you could not determine, instead of resolving it quietly to the convenient answer.
What would help most
Pull requests or comments listing real class/id conventions from comment and review systems, especially non-English ones. This is exactly the kind of knowledge a single author cannot have.