[Webkit-unassigned] [Bug 129172] SVG Data URLs "taint" canvas as cross-origin

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=129172


Dirk Schulze <krit at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |krit at webkit.org




--- Comment #2 from Dirk Schulze <krit at webkit.org>  2014-04-03 01:26:34 PST ---
(In reply to comment #1)
> Correction: Data URIs in UTF8 format (data:image/svg+xml;utf8) and Base64 format (data:image/svg+xml;base64) seem to both taint the canvas; the checks to ensure an SVG source is safe seem to only check an SVG included as a remote file, and don't scan Data URI  contents themselves.

We load the SVG as SVG image which should be save enough, since SVG images already make sure that the security model is followed.

A question: Can you load an embed an external SVG document in the Canvas?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.