[Webkit-unassigned] [Bug 59972] New: QtWebKit bridge assignToHTMLImageElement() results in Image with different SecurityOrigin

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=59972

           Summary: QtWebKit bridge assignToHTMLImageElement() results in
                    Image with different SecurityOrigin
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: WebKit Qt
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rectalogic at rectalogic.com


Created an attachment (id=91999)
 --> (https://bugs.webkit.org/attachment.cgi?id=91999&action=review)
sample Qt app that demonstrates the problem

Attached sample app installs a context object in a QWebPage which has a method that returns a QImage. In the loaded HTML, this image is assigned to a JavaScript Image object then drawn into an HTML canvas via drawImage(). Then getImageData() is called on the canvas.

getImageData() raises an exception "SECURITY_ERR: DOM Exception 18: An attempt was made to break through the security policy of the user agent."

This seems to be because the JS Image contains a CachedImage with no URL, and Source/WebCore/html/canvas/CanvasRenderingContext.cpp CanvasRenderingContext::checkOrigin(HTMLImageElement*) calls checkOrigin(cachedImage->response().url()) and the empty url isValid() is false so it uses a unique SecurityOrigin with an empty KURL(), which is different than the pages SecurityOrigin.

I think images created by the hosting app via the bridge should adopt the SecurityOrigin of the page. Or maybe a QWebSetting should be provided to disable this origin checking? Setting QWebSettings::LocalContentCanAccessRemoteUrls doesn't help.

Build the attached app then run "./origin $PWD/canvas.html"

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.