Skip to content

Commit

Permalink
[giow] (2) Origins should be based on the effective origin.
Browse files Browse the repository at this point in the history
Fixing http://www.w3.org/Bugs/Public/show_bug.cgi?id=14502

git-svn-id: http://svn.whatwg.org/webapps@6776 340c8d12-0b0e-0410-8428-c7bf67bfef74
  • Loading branch information
Hixie committed Oct 28, 2011
1 parent dddea78 commit bbb2e70
Show file tree
Hide file tree
Showing 3 changed files with 63 additions and 60 deletions.
41 changes: 21 additions & 20 deletions complete.html
Expand Up @@ -38545,9 +38545,9 @@ <h5 id=security-with-canvas-elements><span class=secno>4.8.11.3 </span>Security
<ul><li><p>The element's 2D context's <code title=dom-context-2d-drawImage><a href=#dom-context-2d-drawimage>drawImage()</a></code> method is
called with an <code><a href=#htmlimageelement>HTMLImageElement</a></code> or an
<code><a href=#htmlvideoelement>HTMLVideoElement</a></code> whose <a href=#origin>origin</a> is not the
<a href=#same-origin title="same origin">same</a> as that of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element.</li>
<a href=#same-origin title="same origin">same</a> as the <span>effective
origin</span> of the <code><a href=#document>Document</a></code> object that owns the
<code><a href=#the-canvas-element>canvas</a></code> element.</li>

<li><p>The element's 2D context's <code title=dom-context-2d-drawImage><a href=#dom-context-2d-drawimage>drawImage()</a></code> method is
called with an <code><a href=#htmlcanvaselement>HTMLCanvasElement</a></code> whose
Expand All @@ -38557,9 +38557,9 @@ <h5 id=security-with-canvas-elements><span class=secno>4.8.11.3 </span>Security
to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
<code><a href=#htmlimageelement>HTMLImageElement</a></code> or an <code><a href=#htmlvideoelement>HTMLVideoElement</a></code>
whose <a href=#origin>origin</a> was not the <a href=#same-origin title="same
origin">same</a> as that of the <code><a href=#document>Document</a></code> object
that owns the <code><a href=#the-canvas-element>canvas</a></code> element when the pattern was
created.</li>
origin">same</a> as the <span>effective origin</span> of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element when the pattern was created.</li>

<li><p>The element's 2D context's <code title=dom-context-2d-fillStyle><a href=#dom-context-2d-fillstyle>fillStyle</a></code> attribute is set
to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
Expand All @@ -38570,9 +38570,9 @@ <h5 id=security-with-canvas-elements><span class=secno>4.8.11.3 </span>Security
set to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
<code><a href=#htmlimageelement>HTMLImageElement</a></code> or an <code><a href=#htmlvideoelement>HTMLVideoElement</a></code>
whose <a href=#origin>origin</a> was not the <a href=#same-origin title="same
origin">same</a> as that of the <code><a href=#document>Document</a></code> object
that owns the <code><a href=#the-canvas-element>canvas</a></code> element when the pattern was
created.</li>
origin">same</a> as the <span>effective origin</span> of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element when the pattern was created.</li>

<li><p>The element's 2D context's <code title=dom-context-2d-strokeStyle><a href=#dom-context-2d-strokestyle>strokeStyle</a></code> attribute is
set to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
Expand All @@ -38581,14 +38581,14 @@ <h5 id=security-with-canvas-elements><span class=secno>4.8.11.3 </span>Security

<li><p>The element's 2D context's <code title=dom-context-2d-fillText><a href=#dom-context-2d-filltext>fillText()</a></code> or <code title=dom-context-2d-fillText><a href=#dom-context-2d-filltext>strokeText()</a></code> methods are
invoked and consider using a font that has an <a href=#origin>origin</a>
that is not the <a href=#same-origin title="same origin">same</a> as that of
the <code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element. (The font doesn't even have to be used; all that matters
is whether the font was considered for any of the glyphs
drawn.)</li> <!-- because fonts could consider sensitive
material, I guess; and because that sensitivity could extend to
whether or not a particular glyph is in the font in the first
place. -->
that is not the <a href=#same-origin title="same origin">same</a> as the
<span>effective origin</span> of the <code><a href=#document>Document</a></code> object
that owns the <code><a href=#the-canvas-element>canvas</a></code> element. (The font doesn't even
have to be used; all that matters is whether the font was
considered for any of the glyphs drawn.)</li> <!-- because
fonts could consider sensitive material, I guess; and because that
sensitivity could extend to whether or not a particular glyph is in
the font in the first place. -->

</ul><p>Whenever the <code title=dom-canvas-toDataURL><a href=#dom-canvas-todataurl>toDataURL()</a></code> method of a
<code><a href=#the-canvas-element>canvas</a></code> element whose <i>origin-clean</i> flag is set to
Expand All @@ -38604,9 +38604,10 @@ <h5 id=security-with-canvas-elements><span class=secno>4.8.11.3 </span>Security
<p>Whenever the <code title=dom-context-2d-measureText><a href=#dom-context-2d-measuretext>measureText()</a></code> method of
the 2D context of a <code><a href=#the-canvas-element>canvas</a></code> element ends up using a font
that has an <a href=#origin>origin</a> that is not the <a href=#same-origin title="same
origin">same</a> as that of the <code><a href=#document>Document</a></code> object that
owns the <code><a href=#the-canvas-element>canvas</a></code> element, the method must throw a
<code><a href=#securityerror>SecurityError</a></code> exception.</p>
origin">same</a> as the <span>effective origin</span> of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element, the method must throw a <code><a href=#securityerror>SecurityError</a></code>
exception.</p>

<p class=note>Even resetting the canvas state by changing its
<code title=attr-canvas-width><a href=#attr-canvas-width>width</a></code> or <code title=attr-canvas-height><a href=#attr-canvas-height>height</a></code> attributes doesn't reset
Expand Down
41 changes: 21 additions & 20 deletions index
Expand Up @@ -38545,9 +38545,9 @@ function AddCloud(data, x, y) { ... }</pre>
<ul><li><p>The element's 2D context's <code title=dom-context-2d-drawImage><a href=#dom-context-2d-drawimage>drawImage()</a></code> method is
called with an <code><a href=#htmlimageelement>HTMLImageElement</a></code> or an
<code><a href=#htmlvideoelement>HTMLVideoElement</a></code> whose <a href=#origin>origin</a> is not the
<a href=#same-origin title="same origin">same</a> as that of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element.</li>
<a href=#same-origin title="same origin">same</a> as the <span>effective
origin</span> of the <code><a href=#document>Document</a></code> object that owns the
<code><a href=#the-canvas-element>canvas</a></code> element.</li>

<li><p>The element's 2D context's <code title=dom-context-2d-drawImage><a href=#dom-context-2d-drawimage>drawImage()</a></code> method is
called with an <code><a href=#htmlcanvaselement>HTMLCanvasElement</a></code> whose
Expand All @@ -38557,9 +38557,9 @@ function AddCloud(data, x, y) { ... }</pre>
to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
<code><a href=#htmlimageelement>HTMLImageElement</a></code> or an <code><a href=#htmlvideoelement>HTMLVideoElement</a></code>
whose <a href=#origin>origin</a> was not the <a href=#same-origin title="same
origin">same</a> as that of the <code><a href=#document>Document</a></code> object
that owns the <code><a href=#the-canvas-element>canvas</a></code> element when the pattern was
created.</li>
origin">same</a> as the <span>effective origin</span> of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element when the pattern was created.</li>

<li><p>The element's 2D context's <code title=dom-context-2d-fillStyle><a href=#dom-context-2d-fillstyle>fillStyle</a></code> attribute is set
to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
Expand All @@ -38570,9 +38570,9 @@ function AddCloud(data, x, y) { ... }</pre>
set to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
<code><a href=#htmlimageelement>HTMLImageElement</a></code> or an <code><a href=#htmlvideoelement>HTMLVideoElement</a></code>
whose <a href=#origin>origin</a> was not the <a href=#same-origin title="same
origin">same</a> as that of the <code><a href=#document>Document</a></code> object
that owns the <code><a href=#the-canvas-element>canvas</a></code> element when the pattern was
created.</li>
origin">same</a> as the <span>effective origin</span> of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element when the pattern was created.</li>

<li><p>The element's 2D context's <code title=dom-context-2d-strokeStyle><a href=#dom-context-2d-strokestyle>strokeStyle</a></code> attribute is
set to a <code><a href=#canvaspattern>CanvasPattern</a></code> object that was created from an
Expand All @@ -38581,14 +38581,14 @@ function AddCloud(data, x, y) { ... }</pre>

<li><p>The element's 2D context's <code title=dom-context-2d-fillText><a href=#dom-context-2d-filltext>fillText()</a></code> or <code title=dom-context-2d-fillText><a href=#dom-context-2d-filltext>strokeText()</a></code> methods are
invoked and consider using a font that has an <a href=#origin>origin</a>
that is not the <a href=#same-origin title="same origin">same</a> as that of
the <code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element. (The font doesn't even have to be used; all that matters
is whether the font was considered for any of the glyphs
drawn.)</li> <!-- because fonts could consider sensitive
material, I guess; and because that sensitivity could extend to
whether or not a particular glyph is in the font in the first
place. -->
that is not the <a href=#same-origin title="same origin">same</a> as the
<span>effective origin</span> of the <code><a href=#document>Document</a></code> object
that owns the <code><a href=#the-canvas-element>canvas</a></code> element. (The font doesn't even
have to be used; all that matters is whether the font was
considered for any of the glyphs drawn.)</li> <!-- because
fonts could consider sensitive material, I guess; and because that
sensitivity could extend to whether or not a particular glyph is in
the font in the first place. -->

</ul><p>Whenever the <code title=dom-canvas-toDataURL><a href=#dom-canvas-todataurl>toDataURL()</a></code> method of a
<code><a href=#the-canvas-element>canvas</a></code> element whose <i>origin-clean</i> flag is set to
Expand All @@ -38604,9 +38604,10 @@ function AddCloud(data, x, y) { ... }</pre>
<p>Whenever the <code title=dom-context-2d-measureText><a href=#dom-context-2d-measuretext>measureText()</a></code> method of
the 2D context of a <code><a href=#the-canvas-element>canvas</a></code> element ends up using a font
that has an <a href=#origin>origin</a> that is not the <a href=#same-origin title="same
origin">same</a> as that of the <code><a href=#document>Document</a></code> object that
owns the <code><a href=#the-canvas-element>canvas</a></code> element, the method must throw a
<code><a href=#securityerror>SecurityError</a></code> exception.</p>
origin">same</a> as the <span>effective origin</span> of the
<code><a href=#document>Document</a></code> object that owns the <code><a href=#the-canvas-element>canvas</a></code>
element, the method must throw a <code><a href=#securityerror>SecurityError</a></code>
exception.</p>

<p class=note>Even resetting the canvas state by changing its
<code title=attr-canvas-width><a href=#attr-canvas-width>width</a></code> or <code title=attr-canvas-height><a href=#attr-canvas-height>height</a></code> attributes doesn't reset
Expand Down
41 changes: 21 additions & 20 deletions source
Expand Up @@ -42709,9 +42709,9 @@ function AddCloud(data, x, y) { ... }</pre>
title="dom-context-2d-drawImage">drawImage()</code> method is
called with an <code>HTMLImageElement</code> or an
<code>HTMLVideoElement</code> whose <span>origin</span> is not the
<span title="same origin">same</span> as that of the
<code>Document</code> object that owns the <code>canvas</code>
element.</p></li>
<span title="same origin">same</span> as the <span>effective
origin</span> of the <code>Document</code> object that owns the
<code>canvas</code> element.</p></li>

<li><p>The element's 2D context's <code
title="dom-context-2d-drawImage">drawImage()</code> method is
Expand All @@ -42723,9 +42723,9 @@ function AddCloud(data, x, y) { ... }</pre>
to a <code>CanvasPattern</code> object that was created from an
<code>HTMLImageElement</code> or an <code>HTMLVideoElement</code>
whose <span>origin</span> was not the <span title="same
origin">same</span> as that of the <code>Document</code> object
that owns the <code>canvas</code> element when the pattern was
created.</p></li>
origin">same</span> as the <span>effective origin</span> of the
<code>Document</code> object that owns the <code>canvas</code>
element when the pattern was created.</p></li>

<li><p>The element's 2D context's <code
title="dom-context-2d-fillStyle">fillStyle</code> attribute is set
Expand All @@ -42738,9 +42738,9 @@ function AddCloud(data, x, y) { ... }</pre>
set to a <code>CanvasPattern</code> object that was created from an
<code>HTMLImageElement</code> or an <code>HTMLVideoElement</code>
whose <span>origin</span> was not the <span title="same
origin">same</span> as that of the <code>Document</code> object
that owns the <code>canvas</code> element when the pattern was
created.</p></li>
origin">same</span> as the <span>effective origin</span> of the
<code>Document</code> object that owns the <code>canvas</code>
element when the pattern was created.</p></li>

<li><p>The element's 2D context's <code
title="dom-context-2d-strokeStyle">strokeStyle</code> attribute is
Expand All @@ -42752,14 +42752,14 @@ function AddCloud(data, x, y) { ... }</pre>
title="dom-context-2d-fillText">fillText()</code> or <code
title="dom-context-2d-fillText">strokeText()</code> methods are
invoked and consider using a font that has an <span>origin</span>
that is not the <span title="same origin">same</span> as that of
the <code>Document</code> object that owns the <code>canvas</code>
element. (The font doesn't even have to be used; all that matters
is whether the font was considered for any of the glyphs
drawn.)</p></li> <!-- because fonts could consider sensitive
material, I guess; and because that sensitivity could extend to
whether or not a particular glyph is in the font in the first
place. -->
that is not the <span title="same origin">same</span> as the
<span>effective origin</span> of the <code>Document</code> object
that owns the <code>canvas</code> element. (The font doesn't even
have to be used; all that matters is whether the font was
considered for any of the glyphs drawn.)</p></li> <!-- because
fonts could consider sensitive material, I guess; and because that
sensitivity could extend to whether or not a particular glyph is in
the font in the first place. -->

</ul>

Expand All @@ -42780,9 +42780,10 @@ function AddCloud(data, x, y) { ... }</pre>
title="dom-context-2d-measureText">measureText()</code> method of
the 2D context of a <code>canvas</code> element ends up using a font
that has an <span>origin</span> that is not the <span title="same
origin">same</span> as that of the <code>Document</code> object that
owns the <code>canvas</code> element, the method must throw a
<code>SecurityError</code> exception.</p>
origin">same</span> as the <span>effective origin</span> of the
<code>Document</code> object that owns the <code>canvas</code>
element, the method must throw a <code>SecurityError</code>
exception.</p>

<p class="note">Even resetting the canvas state by changing its
<code title="attr-canvas-width">width</code> or <code
Expand Down

0 comments on commit bbb2e70

Please sign in to comment.