(This is a variant of bug 1970468 -- bug 1970468 is a case where we're being stricter than other browsers, whereas this bug is about a case where we're being more permissive. Given that we're more permissive and this in the area of cross-origin security, I'm filing this as security-sensitive, as a precaution.) tl;dr, consider 3 resources/origins: A) a web page served from a particular origin, which references... B) a CSS stylesheet at a different origin, which uses `mask-image` to reference... C) an image from yet-another-origin. For the stylesheet to be usable, it needs to be served with `Access-Control-Allow-Origin: [origin A]` For the mask-image to work, the image file also needs to be served with `Access-Control-Allow-Origin: ...`, but Firefox and Chrome/Safari differ on what `...` should be. * If the image is served with `Access-Control-Allow-Origin: [origin A]`, then it's usable as a mask-image in Chrome and Safari (but not Firefox). (This is what bug 1969852 is about). * If the image is served with `Access-Control-Allow-Origin: [origin B]`, then it's usable as a mask-image in Firefox (but not Chrome and Safari). (This is what I'm filing this bug here to observe/potentially-discuss.) This feels a little broken. Origin C perhaps trusts origin B, but doesn't necessary trust origin A. While origin C allows its image to be used as a mask-image for pages served on origin B, that doesn't necessarily mean that origin C wants its resources to be usable on pages served on other origins that origin B happens to trust. Probably we'll fix both^ of those issues in bug 1970468, but I wanted to have a dedicated place to discuss the possibly security-sensitive aspects here in case it's useful.
Bug 1970490 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
(This is a variant of bug 1970468 -- **that bug** is a case where we're being stricter than other browsers, whereas this bug is about a case where we're being more permissive. Given that we're more permissive and this in the area of cross-origin security, I'm filing this as security-sensitive, as a precaution.) tl;dr, consider 3 resources/origins: A) a web page served from a particular origin, which references... B) a CSS stylesheet at a different origin, which uses `mask-image` to reference... C) an image from yet-another-origin. For the stylesheet to be usable, it needs to be served with `Access-Control-Allow-Origin: [origin A]` For the mask-image to work, the image file also needs to be served with `Access-Control-Allow-Origin: ...`, but Firefox and Chrome/Safari differ on what `...` should be. * If the image is served with `Access-Control-Allow-Origin: [origin A]`, then it's usable as a mask-image in Chrome and Safari (but not Firefox). (This is what bug 1969852 is about). * If the image is served with `Access-Control-Allow-Origin: [origin B]`, then it's usable as a mask-image in Firefox (but not Chrome and Safari). (This is what I'm filing this bug here to observe/potentially-discuss.) This feels a little broken. Origin C perhaps trusts origin B, but doesn't necessary trust origin A. While origin C allows its image to be used as a mask-image for pages served on origin B, that doesn't necessarily mean that origin C wants its resources to be usable on pages served on other origins that origin B happens to trust. Probably we'll fix both^ of those issues in bug 1970468, but I wanted to have a dedicated place to discuss the possibly security-sensitive aspects here in case it's useful.
(This is a variant of bug 1970468 -- **that bug** is a case where we're being stricter than other browsers, whereas **this bug** is about a case where we're being more permissive. I think these are two sides of the same coin -- but given that we're more permissive in the version described here, and this in the area of cross-origin security, I'm filing this as security-sensitive, as a precaution.) tl;dr, consider 3 resources/origins: A) a web page served from a particular origin, which references... B) a CSS stylesheet at a different origin, which uses `mask-image` to reference... C) an image from yet-another-origin. For the stylesheet to be usable, it needs to be served with `Access-Control-Allow-Origin: [origin A]` For the mask-image to work, the image file also needs to be served with `Access-Control-Allow-Origin: ...`, but Firefox and Chrome/Safari differ on what `...` should be. * If the image is served with `Access-Control-Allow-Origin: [origin A]`, then it's usable as a mask-image in Chrome and Safari (but not Firefox). (This is what bug 1969852 is about). * If the image is served with `Access-Control-Allow-Origin: [origin B]`, then it's usable as a mask-image in Firefox (but not Chrome and Safari). (This is what I'm filing this bug here to observe/potentially-discuss.) This feels a little broken. Origin C perhaps trusts origin B, but doesn't necessary trust origin A. While origin C allows its image to be used as a mask-image for pages served on origin B, that doesn't necessarily mean that origin C wants its resources to be usable on pages served on other origins that origin B happens to trust. Probably we'll fix both^ of those issues in bug 1970468, but I wanted to have a dedicated place to discuss the possibly security-sensitive aspects here in case it's useful.
(This is a variant of bug 1970468 -- **that bug** is a case where we're being stricter than other browsers, whereas **this bug** is about a case where we're being more permissive. I think these are two sides of the same coin -- but given that we're more permissive in the version described here, and this in the area of cross-origin security, I'm filing this as security-sensitive, as a precaution.) tl;dr, consider 3 resources/origins: A) a web page served from a particular origin, which references... B) a CSS stylesheet at a different origin, which uses `mask-image` to reference... C) an image from yet-another-origin. For the stylesheet to be usable, it needs to be served with `Access-Control-Allow-Origin: [origin A]` For the mask-image to work, the image file also needs to be served with `Access-Control-Allow-Origin: ...`, but Firefox and Chrome/Safari differ on what `...` should be. * If the image is served with `Access-Control-Allow-Origin: [origin A]`, then it's usable as a mask-image in Chrome and Safari (but not Firefox). (This is what bug 1969852 is about). * If the image is served with `Access-Control-Allow-Origin: [origin B]`, then it's usable as a mask-image in Firefox (but not Chrome and Safari). (This is what I'm filing this bug here to observe/potentially-discuss.) This feels a little broken. Origin C perhaps trusts origin B, but doesn't necessary trust origin A. While origin C allows its image to be used as a mask-image for pages served on origin B, that doesn't necessarily mean that origin C wants its resources to be usable on pages served on other origins that origin B happens to trust. Probably we'll fix both^ of those issues in the same patch [whether on bug 1970468 or here], but I wanted to have a dedicated place to discuss the possibly security-sensitive aspects here in case it's useful.