1368895 - rewrite dom/events/test/test_bug508479.html

Status: RESOLVED INVALID

(Core :: DOM: Security, enhancement, P3)

Comment 1

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

From try to test seems to be crashed.

Also I compare the old behavior, the drop will throw when calling secMan.checkLoadURIStrWithPrincipal
http://searchfox.org/mozilla-central/source/dom/base/contentAreaDropListener.js#129

Because the targetURI(data:image/png...) has the flag, nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT

But the new setup the function returns successfully, and both the images now seems to be dropped.

Comment 2

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

As requested by smaug, he'd like to know if Chrome also treats data:image/png as cross origin, here's the test
https://allstarschh.github.io/test_canvas.html

It turned out that Chrome still treats this as the same origin.
Right now if I turn on the pref in Firefox,
it will throw at https://gist.github.com/allstarschh/40d6ee431fa5522139a523f8ba617be6#file-test_canvas-html-L20
"SecurityError: The operation is insecure."

Smaug, any more suggestion on this?
Should we treat data:image/ differently then other data URI?

Comment 3

[Boris Zbarsky [:bzbarsky]]

> Should we treat data:image/ differently then other data URI?

Have you checked the spec?

Comment 4

[Boris Zbarsky [:bzbarsky]]

And in particular, you're going to have to dig your way through the HTML _and_ fetch specs to figure out what the spec says here.  And probably look at their open issues too.  :(

That said, in this case things are pretty simple: https://fetch.spec.whatwg.org/#concept-main-fetch step 12 special-cases the data: scheme and sets response tainting to "basic".  This, after you dig long and hard through the fetch spec, I believe gives you a response whose type is "basic" and then https://html.spec.whatwg.org/multipage/urls-and-fetching.html#cors-same-origin means the image is CORS-same-origin and https://html.spec.whatwg.org/multipage/origin.html#origin in the image section says the origin of the image is its node document's origin in that case.

Comment 5

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Thanks for Bz's comments, move this bug to invalid as data:image/png should be same origin, which will be fixed in bug 1373513.