Re: [webkit-dev] SVG images with foreignObject inside canvas

[Frédéric WANG]

Le 04/04/2016 22:22, Philip Rogers a écrit :
> Hi Frédéric,
>
> I'm sorry you had to hit this confusing area recently. I just filed
> https://bugs.webkit.org/show_bug.cgi?id=156176 which we can use to
> track progress on this.
>
> The core issue is that foreignObject has the potential to leak
> information (e.g., visited links), and there hasn't been enough user
> interest to justify removing that restriction.
Hi Philip,

Thank you very much for opening the bug!

Yes, I'm aware of this security issue... I did not follow the details
when that happened, but Mozilla has implemented support for
foreignObject inside canvas for several years and there is an article on
MDN describing it:

https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API/Drawing_DOM_objects_into_a_canvas

Maybe it would be worth checking with them what was their rationale to
remove that restriction and if it's worth following the same approach
for Blink/WebKit...

Frédéric



signature.asc
Description: OpenPGP digital signature
___
webkit-dev mailing list
webkit-dev@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-dev

[webkit-dev] SVG images with foreignObject inside canvas

[Frédéric WANG]

Hi,

After bug 119492, SVG images are allowed inside canvas without tainting
as long as they do not contain foreignObject. Two months ago, changeset
195614 landed to make this a bit more secure and the following FIXME
comment was added to SVGImage.cpp:

// FIXME: Once foreignObject elements within SVG images are updated to
not leak cross-origin data
// (e.g., visited links, spellcheck) we can remove the
SVGForeignObjectElement check here and
// research if we can remove the Image::hasSingleSecurityOrigin
mechanism entirely.

Does anyone know if there is any plan / bug report for this?

The FIXME comment misses a bug number, I can not find any bug entry on
Bugzilla (only the related bug 91523 and bug 131033) and I don't have
access to bug 119492...

Thank you,

-- 
Frédéric Wang




signature.asc
Description: OpenPGP digital signature
___
webkit-dev mailing list
webkit-dev@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-dev