Chromium Code Reviews| OLD | NEW |
|---|---|
| (Empty) | |
| 1 <!doctype html> | |
| 2 <script src="/resources/testharness.js"></script> | |
| 3 <script src="/resources/testharnessreport.js"></script> | |
| 4 <body></body> | |
| 5 <script> | |
| 6 var stTest = async_test("Checks no cross-origin on tainted canvas due to SVG ima ge"); | |
| 7 | |
| 8 stTest.step(function() { | |
|
Justin Novosad
2017/03/06 21:37:32
The code below does not need to be inside a 'step'
fs
2017/03/06 22:46:15
I believe there's a positive side to using a step
fserb
2017/03/07 20:44:02
done.
| |
| 9 var canvas = document.createElement("canvas"); | |
| 10 canvas.width = canvas.height = 100; | |
| 11 | |
| 12 var svg = document.createElementNS('http://www.w3.org/2000/svg','svg'); | |
| 13 var image = document.createElementNS("http://www.w3.org/2000/svg", "image"); | |
| 14 svg.appendChild(image); | |
| 15 image.setAttributeNS('http://www.w3.org/1999/xlink','href', | |
| 16 'http://localhost:8000/security/resources/red200x100.png'); | |
| 17 | |
| 18 var ctx = canvas.getContext("2d"); | |
| 19 | |
| 20 image.addEventListener('load', stTest.step_func(function() { | |
|
fs
2017/03/06 22:46:15
Could use step_func_done (and remove the explicit
fserb
2017/03/07 20:44:02
done.
| |
| 21 ctx.drawImage(image, 0, 0); | |
| 22 | |
| 23 assert_throws("SecurityError", function() { | |
| 24 var c = ctx.getImageData(0, 0, 1, 1); | |
| 25 }, "We are trying cross-origin getImageData"); | |
| 26 stTest.done(); | |
| 27 })); | |
| 28 | |
| 29 document.body.appendChild(canvas); | |
| 30 document.body.appendChild(svg); | |
| 31 }); | |
| 32 | |
| 33 </script> | |
| OLD | NEW |