1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
<pre id="console"></pre>
<script>
if (window.layoutTestController) {
layoutTestController.overridePreference("WebKitWebGLEnabled", "1");
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
log = function(msg)
{
document.getElementById('console').appendChild(document.createTextNode(msg + "\n"));
}
testTexImage2D = function(gl, source, description)
{
description = "Calling texImage2D() with a tainted " + description;
try {
gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, source);
log("FAIL: " + description + " was allowed");
} catch (e) {
log("PASS: " + description + " was not allowed: Threw error: " + e + ".");
}
}
testReadPixels = function(gl, description)
{
description = "Calling readPixels() on a canvas where tainting was attempted by a " + description;
try {
var pixels = new Uint8Array(4);
gl.readPixels(0, 0, 1, 1, gl.RGBA, gl.UNSIGNED_BYTE, pixels);
log("PASS: " + description + " was allowed.");
} catch (e) {
log("FAIL: " + description + " was not allowed - Threw error: " + e + ".");
}
}
testToDataURL = function(canvas, description)
{
description = "Calling toDataURL() on a canvas where tainting was attempted by a " + description;
try {
var dataURL = canvas.toDataURL();
log("PASS: " + description + " was allowed.");
} catch (e) {
log("FAIL: " + description + " was not allowed - Threw error: " + e + ".");
}
}
test = function(canvas, description)
{
testReadPixels(canvas.getContext("experimental-webgl"), description);
testToDataURL(canvas, description);
}
var image = new Image();
image.onload = function() {
var canvas = document.createElement("canvas");
canvas.width = 100;
canvas.height = 100;
var gl = canvas.getContext("experimental-webgl");
// Control tests
log("Untainted canvas:");
try {
var pixels = new Uint8Array(4);
gl.readPixels(0, 0, 1, 1, gl.RGBA, gl.UNSIGNED_BYTE, pixels);
log("PASS: Calling readPixels() from an untainted canvas was allowed.");
} catch (e) {
log("FAIL: Calling readPixels() from an untainted canvas was not allowed: Threw error: " + e + ".");
}
try {
var dataURL = canvas.toDataURL();
log("PASS: Calling toDataURL() on an untainted canvas was allowed.");
} catch (e) {
log("FAIL: Calling toDataURL() on an untainted canvas was not allowed: Threw error: " + e + ".");
}
log("\n");
log("Tainted canvas:");
// Test reading from a canvas after uploading a remote image as a texture
var texture = gl.createTexture();
gl.bindTexture(gl.TEXTURE_2D, texture);
testTexImage2D(gl, image, "image");
test(canvas, "remote image");
var dirtyCanvas = canvas;
// Now test reading from a canvas after drawing a tainted canvas onto it
var dirtyCanvas = document.createElement("canvas");
dirtyCanvas.width = 100;
dirtyCanvas.height = 100;
var dirtyContext = dirtyCanvas.getContext("2d");
dirtyContext.drawImage(image, 0, 0, 100, 100);
testTexImage2D(gl, dirtyCanvas, "canvas");
test(canvas, "tainted canvas");
if (window.layoutTestController)
layoutTestController.notifyDone();
}
// Notice that we forget to set the image.crossOrigin property!
image.src = "http://localhost:8000/security/resources/abe-allow-star.php";
</script>
|
