Skip to content

Commit 083c57c

Browse files
junovdomenic
junov
authored and
domenic
committed
Change ImageBitmap to allow cross-origin content
Before this change, the content security policy of ImageBitmap did not allow any cross-origin content in ImageBitmap objects. Attempts to do so would cause SecurityError exceptions to be thrown. With this change, a tainting mechanism is added to ImageBitmap, which allows cross-origin content to be transported by ImageBitmaps while still protecting the bitmap image data from being accessed by script. The tainting mechanism uses an 'origin clean' flag that works much like the 'origin clean' flag of canvas element bitmaps. PR #385
1 parent 19a59f0 commit 083c57c

File tree

1 file changed

+58
-43
lines changed

1 file changed

+58
-43
lines changed

‎source

Lines changed: 58 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -60715,13 +60715,13 @@ callback <dfn>BlobCallback</dfn> = void (<span>Blob</span>? blob);</pre>
6071560715

6071660716
<hr>
6071760717

60718-
<!--ADD-TOPIC:Security-->
60719-
<p>The bitmaps of <code>canvas</code> elements, as well as some of the bitmaps of rendering
60720-
contexts, such as those described in the section on the <code>CanvasRenderingContext2D</code>
60721-
object below, have an <dfn data-x="concept-canvas-origin-clean">origin-clean</dfn> flag, which can
60722-
be set to true or false. Initially, when the <code>canvas</code> element is created, its bitmap's
60723-
<span data-x="concept-canvas-origin-clean">origin-clean</span> flag must be set to true.</p>
60724-
<!--REMOVE-TOPIC:Security-->
60718+
<p>The bitmaps of <code>canvas</code> elements, the bitmaps of <code>ImageBitmap</code> objects,
60719+
as well as some of the bitmaps of rendering contexts, such as those described in the section on
60720+
the <code>CanvasRenderingContext2D</code> object below, have an <dfn
60721+
data-x="concept-canvas-origin-clean">origin-clean</dfn> flag, which can be set to true or false.
60722+
Initially, when the <code>canvas</code> element or <code>ImageBitmap</code> object is created,
60723+
its bitmap's <span data-x="concept-canvas-origin-clean">origin-clean</span> flag must be set to
60724+
true.</p>
6072560725

6072660726
<p>A <code>canvas</code> bitmap can also have a <span>hit region list</span>, as described in the
6072760727
<code>CanvasRenderingContext2D</code> section below.</p>
@@ -67294,7 +67294,6 @@ function AddCloud(data, x, y) { ... }</pre>
6729467294
</div>
6729567295

6729667296

67297-
<!--ADD-TOPIC:Security-->
6729867297
<div w-nodev>
6729967298

6730067299
<h5>Security with <code>canvas</code> elements</h5>
@@ -67305,22 +67304,31 @@ function AddCloud(data, x, y) { ... }</pre>
6730567304
access information (e.g. read pixels) from images from another origin (one that isn't the <span
6730667305
data-x="same origin">same</span>).</p>
6730767306

67308-
<p>To mitigate this, bitmaps used with <code>canvas</code> elements are defined to have a flag
67309-
indicating whether they are <span data-x="concept-canvas-origin-clean">origin-clean</span>. All
67310-
bitmaps start with their <span data-x="concept-canvas-origin-clean">origin-clean</span> set to
67311-
true. The flag is set to false when cross-origin images or fonts are used.</p>
67307+
<p>To mitigate this, bitmaps used with <code>canvas</code> elements and <code>ImageBitmap</code>
67308+
objects are defined to have a flag indicating whether they are <span
67309+
data-x="concept-canvas-origin-clean">origin-clean</span>. All bitmaps start with their <span
67310+
data-x="concept-canvas-origin-clean">origin-clean</span> set to true. The flag is set to
67311+
false when cross-origin images or fonts are used.</p>
6731267312

6731367313
<p>The <code data-x="dom-canvas-toDataURL">toDataURL()</code>, <code
6731467314
data-x="dom-canvas-toBlob">toBlob()</code>, and <code
6731567315
data-x="dom-context-2d-getImageData">getImageData()</code> methods check the flag and will
6731667316
throw a <code>SecurityError</code> exception rather than leak cross-origin data.</p>
6731767317

67318+
<p>The value of the <span data-x="concept-canvas-origin-clean">origin-clean</span> flag is
67319+
propagated from a source <code>canvas</code> element's bitmap to a new <code>ImageBitmap</code>
67320+
object by <code data-x="dom-createImageBitmap">createImageBitmap()</code>. Conversely, a
67321+
destination <code>canvas</code> element's bitmap will have its <span
67322+
data-x="concept-canvas-origin-clean">origin-clean</span> flags set to false by <code
67323+
data-x="dom-context-2d-drawImage">drawImage</code> if the source image is an
67324+
<code>ImageBitmap</code> object whose bitmap has its <span
67325+
data-x="concept-canvas-origin-clean">origin-clean</span> flag set to false.</p>
67326+
6731867327
<p>The flag can be reset in certain situations; for example, when a
67319-
<code>CanvasRenderingContext2D</code> is bound to a new <code>canvas</code>, the bitmap is cleared
67320-
and its flag reset.</p>
67328+
<code>CanvasRenderingContext2D</code> is bound to a new <code>canvas</code>, the bitmap is
67329+
cleared and its flag reset.</p>
6732167330

6732267331
</div>
67323-
<!--REMOVE-TOPIC:Security-->
6732467332

6732567333

6732667334
<!--TOPIC:HTML-->
@@ -90500,9 +90508,15 @@ interface <dfn>ImageBitmapFactories</dfn> {
9050090508
object's media data can be decoded without errors, it is said to be <dfn
9050190509
data-x="concept-ImageBitmap-good">fully decodable</dfn>.</p>
9050290510

90511+
<p>An <code>ImageBitmap</code> object's bitmap has an <span
90512+
data-x="concept-canvas-origin-clean">origin-clean</span> flag, which indicates whether the
90513+
bitmap is tainted by content from a different <span>origin</span>. The flag is initially set to
90514+
true and may be changed to false by the steps of <code
90515+
data-x="dom-createImageBitmap">createImageBitmap()</code>.</p>
90516+
9050390517
<p>An <code>ImageBitmap</code> object can be obtained from a variety of different objects, using
90504-
the <dfn><code data-x="dom-createImageBitmap">createImageBitmap()</code></dfn> method. When invoked, the
90505-
method must act as follows:</p>
90518+
the <dfn><code data-x="dom-createImageBitmap">createImageBitmap()</code></dfn> method. When
90519+
invoked, the method must act as follows:</p>
9050690520
<!-- the canvas createPattern() and drawImage() methods have similar requirements -->
9050790521

9050890522
<dl>
@@ -90520,12 +90534,6 @@ interface <dfn>ImageBitmapFactories</dfn> {
9052090534
available</span>, then return a promise rejected with an <code>InvalidStateError</code> exception and abort these
9052190535
steps.</p></li>
9052290536

90523-
<!--ADD-TOPIC:Security-->
90524-
<li><p>If the <span>origin</span> of the <code>img</code> element's image is not the <span>same
90525-
origin</span> as the <span>origin</span> specified by the <span>entry settings object</span>,
90526-
then return a promise rejected with a <code>SecurityError</code> exception and abort these steps.</p></li>
90527-
<!--REMOVE-TOPIC:Security-->
90528-
9052990537
<li><p>If the <code>img</code> element's media data is not a bitmap (e.g. it's a vector
9053090538
graphic), then return a promise rejected with an <code>InvalidStateError</code> exception and abort these
9053190539
steps.</p></li>
@@ -90539,6 +90547,11 @@ interface <dfn>ImageBitmapFactories</dfn> {
9053990547
supported or is disabled), or, if there is no such image, the first frame of the
9054090548
animation.</p></li>
9054190549

90550+
<li><p>If the <span>origin</span> of the <code>img</code> element's image is not the
90551+
<span>same origin</span> as the <span>origin</span> specified by the <span>entry settings
90552+
object</span>, then set the <span data-x="concept-canvas-origin-clean">origin-clean
90553+
</span> flag of the <code>ImageBitmap</code> object's bitmap to false.</p></li>
90554+
9054290555
<li><p>Return a new promise, but continue running these steps
9054390556
<span>in parallel</span>.</p></li>
9054490557

@@ -90562,12 +90575,6 @@ interface <dfn>ImageBitmapFactories</dfn> {
9056290575
data-x="dom-media-NETWORK_EMPTY">NETWORK_EMPTY</code>, then return a promise rejected with an
9056390576
<code>InvalidStateError</code> exception and abort these steps.</p></li>
9056490577

90565-
<!--ADD-TOPIC:Security-->
90566-
<li><p>If the <span>origin</span> of the <code>video</code> element is not the <span>same
90567-
origin</span> as the <span>origin</span> specified by the <span>entry settings object</span>,
90568-
then return a promise rejected with a <code>SecurityError</code> exception and abort these steps.</p></li>
90569-
<!--REMOVE-TOPIC:Security-->
90570-
9057190578
<li><p>If the <code>video</code> element's <code
9057290579
data-x="dom-media-readyState">readyState</code> attribute is either <code
9057390580
data-x="dom-media-HAVE_NOTHING">HAVE_NOTHING</code> or <code
@@ -90582,6 +90589,11 @@ interface <dfn>ImageBitmapFactories</dfn> {
9058290589
data-x="concept-video-intrinsic-height">intrinsic height</span> (i.e. after any aspect-ratio
9058390590
correction has been applied), <span>cropped to the source rectangle</span>.</p>
9058490591

90592+
<li><p>If the <span>origin</span> of the <code>video</code> element is not the <span>same
90593+
origin</span> as the <span>origin</span> specified by the <span>entry settings object</span>,
90594+
then set the <span data-x="concept-canvas-origin-clean">origin-clean</span> flag of the
90595+
<code>ImageBitmap</code> object's bitmap to false.</p></li>
90596+
9058590597
<li><p>Return a new promise, but continue running these steps
9058690598
<span>in parallel</span>.</p></li>
9058790599

@@ -90600,12 +90612,6 @@ interface <dfn>ImageBitmapFactories</dfn> {
9060090612
<li><p>If either the <var>sw</var> or <var>sh</var> arguments are specified
9060190613
but zero, return a promise rejected with an <code>IndexSizeError</code> exception and abort these steps.</p></li>
9060290614

90603-
<!--ADD-TOPIC:Security-->
90604-
<li><p>If the <code>canvas</code> element's bitmap data does not have its <span
90605-
data-x="concept-canvas-origin-clean">origin-clean</span> flag set, then return a promise rejected with an
90606-
<code>InvalidStateError</code> exception and abort these steps.</p></li>
90607-
<!--REMOVE-TOPIC:Security-->
90608-
9060990615
<li><p>If the <code>canvas</code> element's bitmap has either a horizontal dimension or a
9061090616
vertical dimension equal to zero, then return a promise rejected with an <code>InvalidStateError</code> exception and
9061190617
abort these steps.</p></li>
@@ -90616,6 +90622,11 @@ interface <dfn>ImageBitmapFactories</dfn> {
9061690622
<code>canvas</code> element's bitmap data, <span>cropped to the source
9061790623
rectangle</span>.</p></li>
9061890624

90625+
<li><p>Set the <span data-x="concept-canvas-origin-clean">origin-clean</span> flag of the
90626+
<code>ImageBitmap</code> object's bitmap to the same value as the <span
90627+
data-x="concept-canvas-origin-clean">origin-clean</span> flag of the <code>canvas</code>
90628+
element's bitmap.</p></li>
90629+
9061990630
<li><p>Return a new promise, but continue running these steps
9062090631
<span>in parallel</span>.</p></li>
9062190632

@@ -90707,12 +90718,6 @@ interface <dfn>ImageBitmapFactories</dfn> {
9070790718
<li><p>If either the <var>sw</var> or <var>sh</var> arguments are specified
9070890719
but zero, return a promise rejected with an <code>IndexSizeError</code> exception and abort these steps.</p></li>
9070990720

90710-
<!--ADD-TOPIC:Security-->
90711-
<li><p>If the <code>CanvasRenderingContext2D</code> object's <span>scratch bitmap</span> does
90712-
not have its <span data-x="concept-canvas-origin-clean">origin-clean</span> flag set, then return a promise rejected with
90713-
an <code>InvalidStateError</code> exception and abort these steps.</p></li>
90714-
<!--REMOVE-TOPIC:Security-->
90715-
9071690721
<li><p>If the <code>CanvasRenderingContext2D</code> object's <span>scratch bitmap</span> has
9071790722
either a horizontal dimension or a vertical dimension equal to zero, then return a promise rejected with an
9071890723
<code>InvalidStateError</code> exception and abort these steps.</p></li>
@@ -90723,6 +90728,11 @@ interface <dfn>ImageBitmapFactories</dfn> {
9072390728
<code>CanvasRenderingContext2D</code> object's <span>scratch bitmap</span>, <span>cropped to
9072490729
the source rectangle</span>.</p></li>
9072590730

90731+
<li><p>Set the <span data-x="concept-canvas-origin-clean">origin-clean</span> flag of the
90732+
<code>ImageBitmap</code> object's bitmap to the same value as the <span
90733+
data-x="concept-canvas-origin-clean">origin-clean</span> flag of the
90734+
<code>CanvasRenderingContext2D</code> object's <span>scratch bitmap</span></p></li>
90735+
9072690736
<li><p>Return a new promise, but continue running these steps
9072790737
<span>in parallel</span>.</p></li>
9072890738

@@ -90744,8 +90754,13 @@ interface <dfn>ImageBitmapFactories</dfn> {
9074490754

9074590755
<li><p>Create a new <code>ImageBitmap</code> object.</p></li>
9074690756

90747-
<li><p>Let the <code>ImageBitmap</code> object's bitmap data be a copy of the <var>image</var> argument's bitmap data, <span>cropped to the source
90748-
rectangle</span>.</p></li>
90757+
<li><p>Let the <code>ImageBitmap</code> object's bitmap data be a copy of the <var>image</var>
90758+
argument's bitmap data, <span>cropped to the source rectangle</span>.</p></li>
90759+
90760+
<li><p>Set the <span data-x="concept-canvas-origin-clean">origin-clean</span> flag of the
90761+
<code>ImageBitmap</code> object's bitmap to the same value as the <span
90762+
data-x="concept-canvas-origin-clean">origin-clean</span> flag of the bitmap of the
90763+
<var>image</var> argument.</p></li>
9074990764

9075090765
<li><p>Return a new promise, but continue running these steps
9075190766
<span>in parallel</span>.</p></li>

0 commit comments

Comments
 (0)