Changeset 153876 in webkit


Ignore:
Timestamp:
Aug 8, 2013 11:39:52 PM (11 years ago)
Author:
timothy@apple.com
Message:

Allow SVG images to be drawn into canvas without tainting.
​https://bugs.webkit.org/show_bug.cgi?id=119492

Reviewed by Darin Adler.

Source/WebCore:

Tests: svg/as-image/svg-canvas-not-tainted.html

svg/as-image/svg-canvas-link-not-colored.html
svg/as-image/svg-canvas-xhtml-tainted.html

  • html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::parseAttribute): Call shouldProhibitLinks.
(WebCore::shouldProhibitLinks): Added.

  • html/HTMLAnchorElement.h:
  • html/HTMLImageElement.cpp:

(WebCore::HTMLImageElement::parseAttribute): Call shouldProhibitLinks.

  • rendering/svg/RenderSVGRoot.cpp:

(WebCore::RenderSVGRoot::isEmbeddedThroughSVGImage): Use isInSVGImage.

  • svg/SVGAElement.cpp:

(WebCore::SVGAElement::svgAttributeChanged): Call shouldProhibitLinks.

  • svg/graphics/SVGImage.cpp:

(WebCore::SVGImage::hasSingleSecurityOrigin): Added.
(WebCore::isInSVGImage): Added.

  • svg/graphics/SVGImage.h:

LayoutTests:

  • fast/canvas/svg-taint-expected.txt: Removed.
  • fast/canvas/svg-taint.html: Removed. Obsolete.
  • http/tests/security/canvas-remote-read-data-url-svg-image-expected.txt: Removed.
  • http/tests/security/canvas-remote-read-data-url-svg-image.html: Removed. Obsolete.
  • http/tests/security/canvas-remote-read-svg-image-expected.txt: Removed.
  • http/tests/security/canvas-remote-read-svg-image.html: Removed. Obsolete.
  • svg/as-image/resources/link-xhtml-svg.svg: Added.
  • svg/as-image/resources/link-xhtml.svg: Added.
  • svg/as-image/resources/link.svg: Added.
  • svg/as-image/svg-canvas-link-not-colored-expected.txt: Added.
  • svg/as-image/svg-canvas-link-not-colored.html: Added.
  • svg/as-image/svg-canvas-not-tainted-expected.txt: Added.
  • svg/as-image/svg-canvas-not-tainted.html: Added.
  • svg/as-image/svg-canvas-xhtml-tainted-expected.txt: Added.
  • svg/as-image/svg-canvas-xhtml-tainted.html: Added.
Location:
trunk
Files:
7 added
5 deleted
9 edited
1 moved

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r153873 r153876  
     12013-08-08  Timothy Hatcher  <timothy@apple.com>
     2
     3        Allow SVG images to be drawn into canvas without tainting.
     4        https://bugs.webkit.org/show_bug.cgi?id=119492
     5
     6        Reviewed by Darin Adler.
     7
     8        * fast/canvas/svg-taint-expected.txt: Removed.
     9        * fast/canvas/svg-taint.html: Removed. Obsolete.
     10        * http/tests/security/canvas-remote-read-data-url-svg-image-expected.txt: Removed.
     11        * http/tests/security/canvas-remote-read-data-url-svg-image.html: Removed. Obsolete.
     12        * http/tests/security/canvas-remote-read-svg-image-expected.txt: Removed.
     13        * http/tests/security/canvas-remote-read-svg-image.html: Removed. Obsolete.
     14        * svg/as-image/resources/link-xhtml-svg.svg: Added.
     15        * svg/as-image/resources/link-xhtml.svg: Added.
     16        * svg/as-image/resources/link.svg: Added.
     17        * svg/as-image/svg-canvas-link-not-colored-expected.txt: Added.
     18        * svg/as-image/svg-canvas-link-not-colored.html: Added.
     19        * svg/as-image/svg-canvas-not-tainted-expected.txt: Added.
     20        * svg/as-image/svg-canvas-not-tainted.html: Added.
     21        * svg/as-image/svg-canvas-xhtml-tainted-expected.txt: Added.
     22        * svg/as-image/svg-canvas-xhtml-tainted.html: Added.
     23
    1242013-08-08  Commit Queue  <commit-queue@webkit.org>
    225

  • trunk/LayoutTests/svg/as-image/svg-canvas-xhtml-tainted-expected.txt

    r153875 r153876  
    11CONSOLE MESSAGE: Unable to get image data from canvas because the canvas has been tainted by cross-origin data.
    2 This tests that drawing a SVG image to a canvas taints the canvas
     2PASS window.ctx.getImageData(0, 0, 1, 1) threw exception Error: SecurityError: DOM Exception 18.
    33
    4 PASS: getImageData failed. Canvas tainted.
    5  

  • trunk/Source/WebCore/ChangeLog

    r153875 r153876  
     12013-08-08  Timothy Hatcher  <timothy@apple.com>
     2
     3        Allow SVG images to be drawn into canvas without tainting.
     4        https://bugs.webkit.org/show_bug.cgi?id=119492
     5
     6        Reviewed by Darin Adler.
     7
     8        Tests: svg/as-image/svg-canvas-not-tainted.html
     9               svg/as-image/svg-canvas-link-not-colored.html
     10               svg/as-image/svg-canvas-xhtml-tainted.html
     11
     12        * html/HTMLAnchorElement.cpp:
     13        (WebCore::HTMLAnchorElement::parseAttribute): Call shouldProhibitLinks.
     14        (WebCore::shouldProhibitLinks): Added.
     15        * html/HTMLAnchorElement.h:
     16        * html/HTMLImageElement.cpp:
     17        (WebCore::HTMLImageElement::parseAttribute): Call shouldProhibitLinks.
     18        * rendering/svg/RenderSVGRoot.cpp:
     19        (WebCore::RenderSVGRoot::isEmbeddedThroughSVGImage): Use isInSVGImage.
     20        * svg/SVGAElement.cpp:
     21        (WebCore::SVGAElement::svgAttributeChanged): Call shouldProhibitLinks.
     22        * svg/graphics/SVGImage.cpp:
     23        (WebCore::SVGImage::hasSingleSecurityOrigin): Added.
     24        (WebCore::isInSVGImage): Added.
     25        * svg/graphics/SVGImage.h:
     26
    1272013-08-08  Simon Fraser  <simon.fraser@apple.com>
    228

  • trunk/Source/WebCore/html/HTMLAnchorElement.cpp

    r153772 r153876  
    4343#include "RenderImage.h"
    4444#include "ResourceRequest.h"
     45#include "SVGImage.h"
    4546#include "SecurityOrigin.h"
    4647#include "SecurityPolicy.h"
    … …  
    246247    if (name == hrefAttr) {
    247248        bool wasLink = isLink();
    248         setIsLink(!value.isNull());
     249        setIsLink(!value.isNull() && !shouldProhibitLinks(this));
    249250        if (wasLink != isLink())
    250251            didAffectSelector(AffectedSelectorLink | AffectedSelectorVisited | AffectedSelectorEnabled);
    … …  
    600601}
    601602
     603bool shouldProhibitLinks(Element* element)
     604{
     605#if ENABLE(SVG)
     606    return isInSVGImage(element);
     607#else
     608    return false;
     609#endif
     610}
     611
    602612bool HTMLAnchorElement::willRespondToMouseClickEvents()
    603613{

  • trunk/Source/WebCore/html/HTMLAnchorElement.h

    r153772 r153876  
    170170bool isEnterKeyKeydownEvent(Event*);
    171171bool isLinkClick(Event*);
     172bool shouldProhibitLinks(Element*);
    172173
    173174} // namespace WebCore

  • trunk/Source/WebCore/html/HTMLImageElement.cpp

    r153772 r153876  
    3030#include "EventNames.h"
    3131#include "FrameView.h"
     32#include "HTMLAnchorElement.h"
    3233#include "HTMLDocument.h"
    3334#include "HTMLFormElement.h"
    … …  
    127128        m_bestFitImageURL = bestFitSourceForImageAttributes(deviceScaleFactor, fastGetAttribute(srcAttr), fastGetAttribute(srcsetAttr));
    128129        m_imageLoader.updateFromElementIgnoringPreviousError();
    129     }
    130     else if (name == usemapAttr)
    131         setIsLink(!value.isNull());
     130    } else if (name == usemapAttr)
     131        setIsLink(!value.isNull() && !shouldProhibitLinks(this));
    132132    else if (name == onbeforeloadAttr)
    133133        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, name, value));

  • trunk/Source/WebCore/rendering/svg/RenderSVGRoot.cpp

    r152780 r153876  
    3939#include "RenderSVGResourceContainer.h"
    4040#include "RenderView.h"
     41#include "SVGImage.h"
    4142#include "SVGLength.h"
    4243#include "SVGRenderingContext.h"
    … …  
    125126    if (!node())
    126127        return false;
    127 
    128     Frame* frame = node()->document()->frame();
    129     if (!frame)
    130         return false;
    131 
    132     // Test whether we're embedded through an img.
    133     if (!frame->page())
    134         return false;
    135 
    136     ChromeClient* chromeClient = frame->page()->chrome().client();
    137     if (!chromeClient || !chromeClient->isSVGImageChromeClient())
    138         return false;
    139 
    140     return true;
     128    return isInSVGImage(toSVGSVGElement(node()));
    141129}
    142130

  • trunk/Source/WebCore/svg/SVGAElement.cpp

    r153559 r153876  
    135135    if (SVGURIReference::isKnownAttribute(attrName)) {
    136136        bool wasLink = isLink();
    137         setIsLink(!href().isNull());
    138 
     137        setIsLink(!href().isNull() && !shouldProhibitLinks(this));
    139138        if (wasLink != isLink())
    140139            setNeedsStyleRecalc();

  • trunk/Source/WebCore/svg/graphics/SVGImage.cpp

    r152020 r153876  
    3131#include "SVGImage.h"
    3232
     33#include "Chrome.h"
    3334#include "DocumentLoader.h"
    3435#include "FrameView.h"
    … …  
    3637#include "ImageObserver.h"
    3738#include "IntRect.h"
     39#include "NodeTraversal.h"
    3840#include "RenderSVGRoot.h"
    3941#include "RenderStyle.h"
    … …  
    6062    // Verify that page teardown destroyed the Chrome
    6163    ASSERT(!m_chromeClient || !m_chromeClient->image());
     64}
     65
     66bool SVGImage::hasSingleSecurityOrigin() const
     67{
     68    if (!m_page)
     69        return true;
     70
     71    Frame* frame = m_page->mainFrame();
     72    SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
     73    if (!rootElement)
     74        return true;
     75
     76    // Don't allow foreignObject elements since they can leak information with arbitrary HTML (like spellcheck or control theme).
     77    for (Element* current = ElementTraversal::firstWithin(rootElement); current; current = ElementTraversal::next(current, rootElement)) {
     78        if (current->hasTagName(SVGNames::foreignObjectTag))
     79            return false;
     80    }
     81
     82    // Because SVG image rendering disallows external resources and links,
     83    // these images effectively are restricted to a single security origin.
     84    return true;
    6285}
    6386
    … …  
    372395}
    373396
     397bool isInSVGImage(const Element* element)
     398{
     399    ASSERT(element);
     400
     401    Page* page = element->document()->page();
     402    if (!page)
     403        return false;
     404
     405    ChromeClient* chromeClient = page->chrome().client();
     406    return chromeClient && chromeClient->isSVGImageChromeClient();
     407}
     408
    374409}
    375410

  • trunk/Source/WebCore/svg/graphics/SVGImage.h

    r149193 r153876  
    3434namespace WebCore {
    3535
     36class Element;
    3637class FrameView;
    3738class ImageBuffer;
    … …  
    5354    virtual bool isSVGImage() const { return true; }
    5455    virtual IntSize size() const OVERRIDE { return m_intrinsicSize; }
     56
     57    virtual bool hasSingleSecurityOrigin() const OVERRIDE;
    5558
    5659    virtual bool hasRelativeWidth() const;
    … …  
    98101    IntSize m_intrinsicSize;
    99102};
     103
     104bool isInSVGImage(const Element*);
     105
    100106}
    101107
Note: See TracChangeset for help on using the changeset viewer.