Make OffscreenCanvas WebGL(2) context consider taintedness of image source

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 4830 matching lines @@
                                            GLint internalformat,
                                            GLenum format,
                                            GLenum type,
                                            ImageData* pixels) {
   TexImageHelperImageData(kTexImage2D, target, level, internalformat, 0, format,
                           type, 1, 0, 0, 0, pixels, GetImageDataSize(pixels),
                           0);
 }
 
 void WebGLRenderingContextBase::TexImageHelperHTMLImageElement(
+    SecurityOrigin* security_origin,
     TexImageFunctionID function_id,
     GLenum target,
     GLint level,
     GLint internalformat,
     GLenum format,
     GLenum type,
     GLint xoffset,
     GLint yoffset,
     GLint zoffset,
     HTMLImageElement* image,
     const IntRect& source_image_rect,
     GLsizei depth,
     GLint unpack_image_height,
     ExceptionState& exception_state) {
   const char* func_name = GetTexImageFunctionName(function_id);
   if (isContextLost())
     return;
-  if (!ValidateHTMLImageElement(func_name, image, exception_state))
+
+  if (!ValidateHTMLImageElement(security_origin, func_name, image,
+                                exception_state))
     return;
   if (!ValidateTexImageBinding(func_name, function_id, target))
     return;
 
   RefPtr<Image> image_for_render = image->CachedImage()->GetImage();
   if (image_for_render && image_for_render->IsSVGImage()) {
     if (canvas()) {
       UseCounter::Count(canvas()->GetDocument(), UseCounter::kSVGInWebGL);
     }
     image_for_render = DrawImageIntoBuffer(
@@ skipping 12 matching lines @@
                        xoffset, yoffset, zoffset))
     return;
 
   TexImageImpl(function_id, target, level, internalformat, xoffset, yoffset,
                zoffset, format, type, image_for_render.Get(),
                WebGLImageConversion::kHtmlDomImage, unpack_flip_y_,
                unpack_premultiply_alpha_, source_image_rect, depth,
                unpack_image_height);
 }
 
-void WebGLRenderingContextBase::texImage2D(GLenum target,
+void WebGLRenderingContextBase::texImage2D(ExecutionContext* execution_context,
+                                           GLenum target,
                                            GLint level,
                                            GLint internalformat,
                                            GLenum format,
                                            GLenum type,
                                            HTMLImageElement* image,
                                            ExceptionState& exception_state) {
-  TexImageHelperHTMLImageElement(kTexImage2D, target, level, internalformat,
+  TexImageHelperHTMLImageElement(execution_context->GetSecurityOrigin(),
+                                 kTexImage2D, target, level, internalformat,
                                  format, type, 0, 0, 0, image,
                                  SentinelEmptyRect(), 1, 0, exception_state);
 }
 
 bool WebGLRenderingContextBase::CanUseTexImageByGPU(GLenum type) {
 #if OS(MACOSX)
   // RGB5_A1 is not color-renderable on NVIDIA Mac, see crbug.com/676209.
   // Though, glCopyTextureCHROMIUM can handle RGB5_A1 internalformat by doing a
   // fallback path, but it doesn't know the type info. So, we still cannot do
   // the fallback path in glCopyTextureCHROMIUM for
@@ skipping 136 matching lines @@
     }
     ContextGL()->FramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
                                       GL_TEXTURE_2D, 0, 0);
     RestoreCurrentFramebuffer();
     ContextGL()->DeleteFramebuffers(1, &tmp_fbo);
     ContextGL()->DeleteTextures(1, &target_texture);
   }
 }
 
 void WebGLRenderingContextBase::TexImageHelperHTMLCanvasElement(
+    SecurityOrigin* security_origin,
     TexImageFunctionID function_id,
     GLenum target,
     GLint level,
     GLint internalformat,
     GLenum format,
     GLenum type,
     GLint xoffset,
     GLint yoffset,
     GLint zoffset,
     HTMLCanvasElement* canvas,
     const IntRect& source_sub_rectangle,
     GLsizei depth,
     GLint unpack_image_height,
     ExceptionState& exception_state) {
   const char* func_name = GetTexImageFunctionName(function_id);
   if (isContextLost())
     return;
-  if (!ValidateHTMLCanvasElement(func_name, canvas, exception_state))
+
+  if (!ValidateHTMLCanvasElement(security_origin, func_name, canvas,
+                                 exception_state))
     return;
   WebGLTexture* texture =
       ValidateTexImageBinding(func_name, function_id, target);
   if (!texture)
     return;
   TexImageFunctionType function_type;
   if (function_id == kTexImage2D)
     function_type = kTexImage;
   else
     function_type = kTexSubImage;
@@ skipping 59 matching lines @@
                  canvas
                      ->CopiedImage(kFrontBuffer, kPreferAcceleration,
                                    FunctionIDToSnapshotReason(function_id))
                      .Get(),
                  WebGLImageConversion::kHtmlDomCanvas, unpack_flip_y_,
                  unpack_premultiply_alpha_, source_sub_rectangle, depth,
                  unpack_image_height);
   }
 }
 
-void WebGLRenderingContextBase::texImage2D(GLenum target,
+void WebGLRenderingContextBase::texImage2D(ExecutionContext* execution_context,
+                                           GLenum target,
                                            GLint level,
                                            GLint internalformat,
                                            GLenum format,
                                            GLenum type,
                                            HTMLCanvasElement* canvas,
                                            ExceptionState& exception_state) {
   TexImageHelperHTMLCanvasElement(
-      kTexImage2D, target, level, internalformat, format, type, 0, 0, 0, canvas,
+      execution_context->GetSecurityOrigin(), kTexImage2D, target, level,
+      internalformat, format, type, 0, 0, 0, canvas,
       GetTextureSourceSize(canvas), 1, 0, exception_state);
 }
 
 PassRefPtr<Image> WebGLRenderingContextBase::VideoFrameToImage(
     HTMLVideoElement* video) {
   IntSize size(video->videoWidth(), video->videoHeight());
   ImageBuffer* buf = generated_image_cache_.GetImageBuffer(size);
   if (!buf) {
     SynthesizeGLError(GL_OUT_OF_MEMORY, "texImage2D", "out of memory");
     return nullptr;
   }
   IntRect dest_rect(0, 0, size.Width(), size.Height());
   video->PaintCurrentFrame(buf->Canvas(), dest_rect, nullptr);
   return buf->NewImageSnapshot();
 }
 
 void WebGLRenderingContextBase::TexImageHelperHTMLVideoElement(
+    SecurityOrigin* security_origin,
     TexImageFunctionID function_id,
     GLenum target,
     GLint level,
     GLint internalformat,
     GLenum format,
     GLenum type,
     GLint xoffset,
     GLint yoffset,
     GLint zoffset,
     HTMLVideoElement* video,
     const IntRect& source_image_rect,
     GLsizei depth,
     GLint unpack_image_height,
     ExceptionState& exception_state) {
   const char* func_name = GetTexImageFunctionName(function_id);
   if (isContextLost())
     return;
-  if (!ValidateHTMLVideoElement(func_name, video, exception_state))
+
+  if (!ValidateHTMLVideoElement(security_origin, func_name, video,
+                                exception_state))
     return;
   WebGLTexture* texture =
       ValidateTexImageBinding(func_name, function_id, target);
   if (!texture)
     return;
   TexImageFunctionType function_type;
   if (function_id == kTexImage2D || function_id == kTexImage3D)
     function_type = kTexImage;
   else
     function_type = kTexSubImage;
@@ skipping 105 matching lines @@
     GLuint target_texture,
     bool flip_y,
     GLint xoffset,
     GLint yoffset,
     const IntRect& source_sub_rect) {
   bitmap->BitmapImage()->CopyToTexture(
       GetDrawingBuffer()->ContextProvider(), target, target_texture, flip_y,
       IntPoint(xoffset, yoffset), source_sub_rect);
 }
 
-void WebGLRenderingContextBase::texImage2D(GLenum target,
+void WebGLRenderingContextBase::texImage2D(ExecutionContext* execution_context,
+                                           GLenum target,
                                            GLint level,
                                            GLint internalformat,
                                            GLenum format,
                                            GLenum type,
                                            HTMLVideoElement* video,
                                            ExceptionState& exception_state) {
-  TexImageHelperHTMLVideoElement(kTexImage2D, target, level, internalformat,
+  TexImageHelperHTMLVideoElement(execution_context->GetSecurityOrigin(),
+                                 kTexImage2D, target, level, internalformat,
                                  format, type, 0, 0, 0, video,
                                  SentinelEmptyRect(), 1, 0, exception_state);
 }
 
 void WebGLRenderingContextBase::TexImageHelperImageBitmap(
     TexImageFunctionID function_id,
     GLenum target,
     GLint level,
     GLint internalformat,
     GLenum format,
@@ skipping 224 matching lines @@
                                               GLint xoffset,
                                               GLint yoffset,
                                               GLenum format,
                                               GLenum type,
                                               ImageData* pixels) {
   TexImageHelperImageData(kTexSubImage2D, target, level, 0, 0, format, type, 1,
                           xoffset, yoffset, 0, pixels, GetImageDataSize(pixels),
                           0);
 }
 
-void WebGLRenderingContextBase::texSubImage2D(GLenum target,
-                                              GLint level,
-                                              GLint xoffset,
-                                              GLint yoffset,
-                                              GLenum format,
-                                              GLenum type,
-                                              HTMLImageElement* image,
-                                              ExceptionState& exception_state) {
-  TexImageHelperHTMLImageElement(kTexSubImage2D, target, level, 0, format, type,
+void WebGLRenderingContextBase::texSubImage2D(
+    ExecutionContext* execution_context,
+    GLenum target,
+    GLint level,
+    GLint xoffset,
+    GLint yoffset,
+    GLenum format,
+    GLenum type,
+    HTMLImageElement* image,
+    ExceptionState& exception_state) {
+  TexImageHelperHTMLImageElement(execution_context->GetSecurityOrigin(),
+                                 kTexSubImage2D, target, level, 0, format, type,
                                  xoffset, yoffset, 0, image,
                                  SentinelEmptyRect(), 1, 0, exception_state);
 }
 
-void WebGLRenderingContextBase::texSubImage2D(GLenum target,
-                                              GLint level,
-                                              GLint xoffset,
-                                              GLint yoffset,
-                                              GLenum format,
-                                              GLenum type,
-                                              HTMLCanvasElement* canvas,
-                                              ExceptionState& exception_state) {
+void WebGLRenderingContextBase::texSubImage2D(
+    ExecutionContext* execution_context,
+    GLenum target,
+    GLint level,
+    GLint xoffset,
+    GLint yoffset,
+    GLenum format,
+    GLenum type,
+    HTMLCanvasElement* canvas,
+    ExceptionState& exception_state) {
   TexImageHelperHTMLCanvasElement(
-      kTexSubImage2D, target, level, 0, format, type, xoffset, yoffset, 0,
-      canvas, GetTextureSourceSize(canvas), 1, 0, exception_state);
+      execution_context->GetSecurityOrigin(), kTexSubImage2D, target, level, 0,
+      format, type, xoffset, yoffset, 0, canvas, GetTextureSourceSize(canvas),
+      1, 0, exception_state);
 }
 
-void WebGLRenderingContextBase::texSubImage2D(GLenum target,
-                                              GLint level,
-                                              GLint xoffset,
-                                              GLint yoffset,
-                                              GLenum format,
-                                              GLenum type,
-                                              HTMLVideoElement* video,
-                                              ExceptionState& exception_state) {
-  TexImageHelperHTMLVideoElement(kTexSubImage2D, target, level, 0, format, type,
+void WebGLRenderingContextBase::texSubImage2D(
+    ExecutionContext* execution_context,
+    GLenum target,
+    GLint level,
+    GLint xoffset,
+    GLint yoffset,
+    GLenum format,
+    GLenum type,
+    HTMLVideoElement* video,
+    ExceptionState& exception_state) {
+  TexImageHelperHTMLVideoElement(execution_context->GetSecurityOrigin(),
+                                 kTexSubImage2D, target, level, 0, format, type,
                                  xoffset, yoffset, 0, video,
                                  SentinelEmptyRect(), 1, 0, exception_state);
 }
 
 void WebGLRenderingContextBase::texSubImage2D(GLenum target,
                                               GLint level,
                                               GLint xoffset,
                                               GLint yoffset,
                                               GLenum format,
                                               GLenum type,
@@ skipping 1652 matching lines @@
 }
 
 void WebGLRenderingContextBase::RemoveBoundBuffer(WebGLBuffer* buffer) {
   if (bound_array_buffer_ == buffer)
     bound_array_buffer_ = nullptr;
 
   bound_vertex_array_object_->UnbindBuffer(buffer);
 }
 
 bool WebGLRenderingContextBase::ValidateHTMLImageElement(
+    SecurityOrigin* security_origin,
     const char* function_name,
     HTMLImageElement* image,
     ExceptionState& exception_state) {
   if (!image || !image->CachedImage()) {
     SynthesizeGLError(GL_INVALID_VALUE, function_name, "no image");
     return false;
   }
   const KURL& url = image->CachedImage()->GetResponse().Url();
   if (url.IsNull() || url.IsEmpty() || !url.IsValid()) {
     SynthesizeGLError(GL_INVALID_VALUE, function_name, "invalid image");
     return false;
   }
 
-  if (WouldTaintOrigin(image)) {
+  if (WouldTaintOrigin(image, security_origin)) {
     exception_state.ThrowSecurityError("The cross-origin image at " +
                                        url.ElidedString() +
                                        " may not be loaded.");
     return false;
   }
   return true;
 }
 
 bool WebGLRenderingContextBase::ValidateHTMLCanvasElement(
+    SecurityOrigin* security_origin,
     const char* function_name,
     HTMLCanvasElement* canvas,
     ExceptionState& exception_state) {
   if (!canvas || !canvas->IsPaintable()) {
     SynthesizeGLError(GL_INVALID_VALUE, function_name, "no canvas");
     return false;
   }
-  if (WouldTaintOrigin(canvas)) {
+
+  if (WouldTaintOrigin(canvas, security_origin)) {
     exception_state.ThrowSecurityError("Tainted canvases may not be loaded.");
     return false;
   }
   return true;
 }
 
 bool WebGLRenderingContextBase::ValidateHTMLVideoElement(
+    SecurityOrigin* security_origin,
     const char* function_name,
     HTMLVideoElement* video,
     ExceptionState& exception_state) {
   if (!video || !video->videoWidth() || !video->videoHeight()) {
     SynthesizeGLError(GL_INVALID_VALUE, function_name, "no video");
     return false;
   }
 
-  if (WouldTaintOrigin(video)) {
+  if (WouldTaintOrigin(video, security_origin)) {
     exception_state.ThrowSecurityError(
         "The video element contains cross-origin data, and may not be loaded.");
     return false;
   }
   return true;
 }
 
 bool WebGLRenderingContextBase::ValidateImageBitmap(
     const char* function_name,
     ImageBitmap* bitmap,
@@ skipping 460 matching lines @@
 
 void WebGLRenderingContextBase::getHTMLOrOffscreenCanvas(
     HTMLCanvasElementOrOffscreenCanvas& result) const {
   if (canvas())
     result.setHTMLCanvasElement(canvas());
   else
     result.setOffscreenCanvas(offscreenCanvas());
 }
 
 }  // namespace blink