1532648 - Produce the algorithm that determines whether something is an image

Status: RESOLVED WONTFIX

(Core :: Graphics: ImageLib, enhancement, P3)

Description

[Anne (:annevk)]

To be able to block more "no-cors" cross-origin responses from entering the content process it would be good to know what we currently handle as images.

I'm pretty sure we look at Content-Type for image/svg+xml and the decoding process looks at the initial set of bytes of a response. Is this fully documented somewhere?

https://mimesniff.spec.whatwg.org/#matching-an-image-type-pattern covers this. Might that be all?

(Not sure if ImageLib is appropriate. Sorry if it's not.)

Comment 1

[Tom Tung [:tt, :ttung]]

(In reply to Anne (:annevk) from comment #0)

https://mimesniff.spec.whatwg.org/#matching-an-image-type-pattern covers this. Might that be all?

It seems that https://searchfox.org/mozilla-central/rev/c7cf087b6e1384608ca3989f042f12f7cabd0a5f/image/imgLoader.cpp#2717-2797 is the code for that.

Comment 2

[Sean Feng [:sefeng]]

Hi Tom, I'd like to help on this bug. However I don't seem to understand what we'd like to do here. Is the task here to validate the code you linked in comment 1 with https://mimesniff.spec.whatwg.org/#matching-an-image-type-pattern? It'd be great if you can give me some pointers. Thanks!

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:aosmond, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Sean Feng [:sefeng]]

The DOM team has talked about this and clarified my question. So no needinfo is needed.

Comment 5

[Sean Feng [:sefeng]]

I did a comparison between our implementation and the existing image type pattern algorithm, and I only see one difference.

We have a sniffing for ART type https://searchfox.org/mozilla-central/rev/c7cf087b6e1384608ca3989f042f12f7cabd0a5f/image/imgLoader.cpp#2768-2771, which doesn't exist in the spec.

I think it's obsolete nowadays and we don't need to worry about that. As that being said, the image sniffing code used by ORB matches the existing spec, so we don't need to extra work here.