1869202 - taint filter if colour is currentColor

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Robert Longson [:longsonr]]

See https://www.w3.org/TR/filter-effects-1/#tainted-filter-primitives

Comment 1

[Robert Longson [:longsonr]]

https://treeherder.mozilla.org/jobs?repo=try&revision=4ea88ffb9ef8530c8705eefcce6e93ef69c7bfe5

Comment 2

[Robert Longson [:longsonr]]

Attachment: Bug 1869202 - taint filter if input is currentColor r=emilio

See https://www.w3.org/TR/filter-effects-1/#tainted-filter-primitives

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/25a3d6c779f3
taint filter if input is currentColor r=emilio

Comment 4

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/25a3d6c779f3

Comment 5

[Robert Longson [:longsonr]]

Release Note Request (optional, but appreciated)
[Why is this notable]:
This is a privacy improvement.
[Affects Firefox for Android]:
yes
[Suggested wording]:
To further protect user's privacy Firefox now taints filters that use currentColor as an input. Since color can be set by the :visited pseudo selector, it potentially contains privacy-sensitive information and therefore these primitives must be marked as tainted. This means that if you use such a filter you won't be able to read the filter output from canvas.
[Links (documentation, blog post, etc)]:
https://www.w3.org/TR/filter-effects-1/#tainted-filter-primitives