Require the entire document-tree of an SVGImage to be single-origin

Source/core/svg/graphics/SVGImage.cpp

 /*
  * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 81 matching lines @@
     SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
     if (!rootElement)
         return true;
 
     // Don't allow foreignObject elements or images that are not known to be
     // single-origin since these can leak cross-origin information.
     ComposedTreeWalker walker(rootElement);
     while (Node* node = walker.get()) {
         if (node->hasTagName(SVGNames::foreignObjectTag))
             return false;
-        if (node->hasTagName(SVGNames::imageTag))
-            return toSVGImageElement(node)->currentFrameHasSingleSecurityOrigin();
-        if (node->hasTagName(SVGNames::feImageTag))
-            return toSVGFEImageElement(node)->currentFrameHasSingleSecurityOrigin();
+        if (node->hasTagName(SVGNames::imageTag)) {
+            if (!toSVGImageElement(node)->currentFrameHasSingleSecurityOrigin())
+                return false;
+        } else if (node->hasTagName(SVGNames::feImageTag)) {
+            if (!toSVGFEImageElement(node)->currentFrameHasSingleSecurityOrigin())
+                return false;
+        }
         walker.next();
     }
 
     // Because SVG image rendering disallows external resources and links, these
     // images effectively are restricted to a single security origin.
     return true;
 }
 
 void SVGImage::setContainerSize(const IntSize& size)
 {
@@ skipping 294 matching lines @@
 
     return m_page;
 }
 
 String SVGImage::filenameExtension() const
 {
     return "svg";
 }
 
 }