Hi, After bug 119492, SVG images are allowed inside canvas without tainting as long as they do not contain foreignObject. Two months ago, changeset 195614 landed to make this a bit more secure and the following FIXME comment was added to SVGImage.cpp:
// FIXME: Once foreignObject elements within SVG images are updated to not leak cross-origin data // (e.g., visited links, spellcheck) we can remove the SVGForeignObjectElement check here and // research if we can remove the Image::hasSingleSecurityOrigin mechanism entirely. Does anyone know if there is any plan / bug report for this? The FIXME comment misses a bug number, I can not find any bug entry on Bugzilla (only the related bug 91523 and bug 131033) and I don't have access to bug 119492... Thank you, -- Frédéric Wang
signature.asc
Description: OpenPGP digital signature
_______________________________________________ webkit-dev mailing list [email protected] https://lists.webkit.org/mailman/listinfo/webkit-dev
