Allow SVG images to not taint the canvas with drawImage/drawPattern

Source/core/svg/graphics/SVGImage.cpp

 /*
  * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 11 matching lines @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 
 #include "core/svg/graphics/SVGImage.h"
 
+#include "core/dom/NodeTraversal.h"
 #include "core/loader/DocumentLoader.h"
+#include "core/page/Chrome.h"
 #include "core/page/FrameView.h"
 #include "core/page/Settings.h"
 #include "core/platform/graphics/GraphicsContextStateSaver.h"
 #include "core/platform/graphics/ImageBuffer.h"
 #include "core/platform/graphics/ImageObserver.h"
 #include "core/platform/graphics/IntRect.h"
 #include "core/rendering/style/RenderStyle.h"
 #include "core/rendering/svg/RenderSVGRoot.h"
 #include "core/svg/SVGDocument.h"
+#include "core/svg/SVGImageElement.h"
 #include "core/svg/SVGSVGElement.h"
 #include "core/svg/graphics/SVGImageChromeClient.h"
 #include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 SVGImage::SVGImage(ImageObserver* observer)
     : Image(observer)
 {
 }
 
 SVGImage::~SVGImage()
 {
     if (m_page) {
         // Store m_page in a local variable, clearing m_page, so that SVGImageChromeClient knows we're destructed.
         OwnPtr<Page> currentPage = m_page.release();
         currentPage->mainFrame()->loader()->frameDetached(); // Break both the loader and view references to the frame
     }
 
     // Verify that page teardown destroyed the Chrome
     ASSERT(!m_chromeClient || !m_chromeClient->image());
 }
 
+bool SVGImage::isInSVGImage(const Element* element)
+{
+    ASSERT(element);
+
+    Page* page = element->document()->page();
+    if (!page)
+        return false;
+
+    ChromeClient* chromeClient = page->chrome().client();
+    return chromeClient && chromeClient->isSVGImageChromeClient();
+}
+
+bool SVGImage::hasSingleSecurityOrigin() const
+{
+    if (!m_page)
+        return true;
+
+    Frame* frame = m_page->mainFrame();
+    SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
+    if (!rootElement)
+        return true;
+
+    // Don't allow foreignObject elements or images that are not known to be
+    // single-origin since these can leak cross-origin information.
+    for (Element* element = ElementTraversal::firstWithin(rootElement); element; element = ElementTraversal::next(element, rootElement)) {

[abarth-chromium, 2013/08/12 19:47:44]

Does this traverse shadow DOM?

[pdr., 2013/08/19 23:16:17]

Fortunately, custom elements cannot be created declaratively so I think we're
good here.

+        if (element->hasTagName(SVGNames::foreignObjectTag))
+            return false;
+        // FIXME(crbug.com/249037): Images should be allowed but the
+        // implementation is difficult because images can have animations which
+        // cause them to dynamically change their single-origin state.
+        if (element->hasTagName(SVGNames::imageTag))
+            return false;
+        if (element->hasTagName(SVGNames::feImageTag))

[Tom Sepez, 2013/08/15 17:53:59]

I worry about folks introducing a new element type and not updating this
blacklist. Is there a way to make this determination via virtual method of an
element with only the safe SVG ones overriding it with "true" (whitelist
approach)?

[pdr., 2013/08/19 23:16:17]

I think this will actually end up being prohibitively expensive to do :/

+            return false;
+    }
+
+    // Because SVG image rendering disallows external resources and links, these
+    // images effectively are restricted to a single security origin.
+    return true;
+}
+
 void SVGImage::setContainerSize(const IntSize& size)
 {
     if (!m_page || !usesContainerSize())
         return;
 
     Frame* frame = m_page->mainFrame();
     SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
     if (!rootElement)
         return;
     RenderSVGRoot* renderer = toRenderSVGRoot(rootElement->renderer());
@@ skipping 289 matching lines @@
     return m_page;
 }
 
 String SVGImage::filenameExtension() const
 {
     return "svg";
 }
 
 }