meltingice / CamanJS

Javascript HTML5 (Ca)nvas (Man)ipulation
http://camanjs.com
BSD 3-Clause "New" or "Revised" License
3.55k stars 404 forks source link

False cross-origin detection on a domain name with hyphen #172

Open purado opened 9 years ago

purado commented 9 years ago

Converting an img to a canvas worked fine on a local server. Problems occured after uploading to a server with a hyphen in the domain name. Now, the image wasn't replaced any more in some browsers. Tested with Chrome 41.0.2272.118 m. Found out that Caman tried to load the image via proxy. Chrome console said:

Resource interpreted as Image but transferred with MIME type text/html: "http://www.ex-ample.de/demos/test.html?camanProxyUrl=http%3A%2F%2Fwww.ex-ample.de%2Fdemos%2Fdemoimages%2Fbackground.jpg".

It seemed as CamanJs detects a violence of the cross-origin policy, which isn't there. To verify my assumption I added an alert to CamanJS:

IO.isURLRemote = function(url) {
  var matches;
  matches = url.match(this.domainRegex);
  if (matches) {
    alert(matches[1]);
    return matches[1] !== document.domain;
  } else {
    return false;
  }
};

Alert says: "www.ex" So the string is cut off starting with the hyphen.

As a dirty workaround I changed IO.isURLRemote to return FALSE in every case.

Thanks for bringing us CamanJS, great tool!

purado commented 9 years ago

Sorry, just saw there is already an issue (#158) with a fix for the regex: IO.domainRegex = /(?:(?:http|https):\/\/)((?:[a-zA-Z0-9-]+).(?:(?:[a-zA-Z0-9-]*|.)+))/;