Usually warning
SEC7115: :visited and :link styles can only differ by color. Some styles were not applied to :visited.
is a false positive. Internet Explorer "F12 Development Tools" is not clever enough to figure out that
a:link, a:visited { border: solid red 1px; }
is not an information leak even tough getComputedStyle()
were used. As explained at https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ and https://dbaron.org/mozilla/visited-privacy if :visited
visually differs from :link
and JavaScript can detect this difference, JS can brute force browser history.
However, IE detection of this case is poor enough that it cannot figure out that there's NO visual difference between :link
(unvisited link) and :visited
(visited link). I guess the heuristics are just if (selector_contains_visited && rule_contains_property_other_than_color) { emit_warning(); }
.
Unfortunately, there's no much you can do to fix the issue. Most user agents have default style sheets that require author style sheet to match both :link
and :visited
(because common user agents do not support a pseudo selector matching both unvisited and visited links and specificity rules require using at least one pseudo selector). As a result, you have to specify :link, :visited {...}
and IE will emit the above warning if rule block contains any property other that color
.