Skip to content

/ servo

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WebGL: Allow TexImage from a different origin if CORS used #24330

Closed
paulrouget opened this issue Oct 1, 2019 · 3 comments
Closed

WebGL: Allow TexImage from a different origin if CORS used #24330

paulrouget opened this issue Oct 1, 2019 · 3 comments
Assignees
@jdm
Labels
A-content/webgl

Comments

@paulrouget
Copy link
Contributor

@paulrouget paulrouget commented Oct 1, 2019

servo/components/script/dom/webglrenderingcontext.rs

Line 567 in cf725fc

TexImageSource::HTMLImageElement(image) => {

@paulrouget paulrouget changed the title Allow TexImage from a different origin if CORS used WebGL: Allow TexImage from a different origin if CORS used Oct 1, 2019
@paulrouget paulrouget mentioned this issue Oct 1, 2019
Closed
@paulrouget
Copy link
Contributor Author

@paulrouget paulrouget commented Oct 1, 2019

@jdm: Is it just a matter of checking the cross origin attribute or it's more convoluted?
@jdm
Copy link
Member

@jdm jdm commented Oct 1, 2019

@paulrouget it requires storing some information at https://github.com/servo/servo/blob/master/components/script/dom/htmlimageelement.rs#L192 about what kind of filtering was present in the response body. If it's opaque, then CORS should not allow reading from the image. Otherwise we should be able to allow it.
@jdm jdm self-assigned this Oct 1, 2019
@jdm
Copy link
Member

@jdm jdm commented Oct 1, 2019

I'll fix this today.
@jdm jdm mentioned this issue Oct 1, 2019
Merged
4 of 4 tasks complete
bors-servo added a commit that referenced this issue Oct 1, 2019
@bors-servo
Auto merge of #24340 - jdm:image-cache-cors, r=<try>
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
daef8bd 
Allow using CORS filtered image responses as WebGL textures

More specifically, this makes the "is this image same origin?" check consider the CORS status of the original response, rather than relying on an overly-strict "is this image's response's URL same-origin with a particular global?" check. To do this, we make the image cache double keyed based on the requested URL as well as the requesting origin, and store the CORS status of the eventual response with the final image that eventually gets sent to the HTMLImageElement consumer.

---
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #24330
- [x] There are tests for these changes

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/24340)
<!-- Reviewable:end -->
bors-servo added a commit that referenced this issue Oct 1, 2019
@bors-servo
Auto merge of #24340 - jdm:image-cache-cors, r=<try>
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
8657576 
Allow using CORS filtered image responses as WebGL textures

More specifically, this makes the "is this image same origin?" check consider the CORS status of the original response, rather than relying on an overly-strict "is this image's response's URL same-origin with a particular global?" check. To do this, we make the image cache double keyed based on the requested URL as well as the requesting origin, and store the CORS status of the eventual response with the final image that eventually gets sent to the HTMLImageElement consumer.

---
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #24330
- [x] There are tests for these changes

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/24340)
<!-- Reviewable:end -->
bors-servo added a commit that referenced this issue Oct 3, 2019
@bors-servo
Auto merge of #24340 - jdm:image-cache-cors, r=<try>
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
d1b95d9 
Allow using CORS filtered image responses as WebGL textures

More specifically, this makes the "is this image same origin?" check consider the CORS status of the original response, rather than relying on an overly-strict "is this image's response's URL same-origin with a particular global?" check. To do this, we make the image cache double keyed based on the requested URL as well as the requesting origin, and store the CORS status of the eventual response with the final image that eventually gets sent to the HTMLImageElement consumer.

---
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #24330
- [x] There are tests for these changes

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/24340)
<!-- Reviewable:end -->
bors-servo added a commit that referenced this issue Oct 4, 2019
@bors-servo
Auto merge of #24340 - jdm:image-cache-cors, r=<try>
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
19af1cf 
Allow using CORS filtered image responses as WebGL textures

More specifically, this makes the "is this image same origin?" check consider the CORS status of the original response, rather than relying on an overly-strict "is this image's response's URL same-origin with a particular global?" check. To do this, we make the image cache double keyed based on the requested URL as well as the requesting origin, and store the CORS status of the eventual response with the final image that eventually gets sent to the HTMLImageElement consumer.

---
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #24330 and fix #24368
- [x] There are tests for these changes

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/24340)
<!-- Reviewable:end -->
bors-servo added a commit that referenced this issue Oct 7, 2019
@bors-servo
Auto merge of #24340 - jdm:image-cache-cors, r=Manishearth
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
b90c28c 
Allow using CORS filtered image responses as WebGL textures

More specifically, this makes the "is this image same origin?" check consider the CORS status of the original response, rather than relying on an overly-strict "is this image's response's URL same-origin with a particular global?" check. To do this, we make the image cache double keyed based on the requested URL as well as the requesting origin, and store the CORS status of the eventual response with the final image that eventually gets sent to the HTMLImageElement consumer.

---
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #24330 and fix #24368
- [x] There are tests for these changes

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/24340)
<!-- Reviewable:end -->
@bors-servo bors-servo closed this in 75548f4 Oct 8, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jdm jdm

Labels
A-content/webgl
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

Allow using CORS filtered image responses as WebGL textures
2 participants
@jdm @paulrouget
You can’t perform that action at this time.