search

whatwg / html

HTML Standard
https://html.spec.whatwg.org/multipage/
Other
7.87k stars 2.58k forks source link

"The image argument is not origin-clean" check allows tainted ImageBitmaps #3341

Open Ms2ger opened 6 years ago

Ms2ger commented 6 years ago

https://html.spec.whatwg.org/multipage/canvas.html#the-image-argument-is-not-origin-clean

The image argument is not origin-clean if it is an HTMLOrSVGImageElement or HTMLVideoElement whose origin is not the same as the origin specified by the entry settings object, or if it is an HTMLCanvasElement whose bitmap's origin-clean flag is false.

In particular, it doesn't check for ImageBitmap arguments, so the following doesn't taint the canvas:

createImageBitmap(crossOriginVideo).then(bitmap => ctx.drawImage(bitmap))
annevk commented 6 years ago

I wish there was a more sound approach we could use than forwarding bits across objects.

Ms2ger commented 6 years ago

Perhaps a switch across the possible types of the image argument would at least make it obvious that ImageBitmap was forgotten.

annevk commented 6 years ago

OffScreenCanvas is also missing from this list (and a similar list slightly higher up).

annevk commented 6 years ago

@junov as far as I can tell OffscreenCanvasRenderingContext2D has an origin-clean bit, but OffscreenCanvas itself does not?