Skip to content

Commit 2dc8b93

Browse files
niklasvhniklasvh
committed
SVG taint fix, and additional taint testing options
1 parent 6ef6c79 commit 2dc8b93

4 files changed

Lines changed: 75 additions & 6 deletions

File tree

‎src/Preload.js‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ html2canvas.Preload = function(element, opts){
3232
return (img.crossOrigin !== undefined);
3333
})(new Image()),
3434
timeoutTimer;
35-
35+
3636
link.href = window.location.href;
3737
pageOrigin = link.protocol + link.host;
3838
opts = opts || {};
@@ -44,8 +44,9 @@ html2canvas.Preload = function(element, opts){
4444
element = element || doc.body;
4545

4646
function isSameOrigin(url){
47-
link.href = url;
48-
var origin = link.protocol + link.host;
47+
link.href = url;
48+
link.href = link.href; // YES, BELIEVE IT OR NOT, that is required for IE9 - http://jsfiddle.net/niklasvh/2e48b/
49+
var origin = link.protocol + link.host;
4950
return (origin === pageOrigin);
5051
}
5152

@@ -240,7 +241,7 @@ html2canvas.Preload = function(element, opts){
240241
imageObj = images[src] = { img: img };
241242
images.numTotal++;
242243
setImageLoadHandlers(img, imageObj);
243-
} else if ( isSameOrigin( src ) || options.allowTaint === true ) {
244+
} else if ( isSameOrigin( src ) || options.allowTaint === true ) {
244245
imageObj = images[src] = { img: img };
245246
images.numTotal++;
246247
setImageLoadHandlers(img, imageObj);

‎src/Renderer.js‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ html2canvas.Renderer = function(parseQueue, opts){
1111
var options = {
1212
"width": null,
1313
"height": null,
14-
"renderer": "canvas"
14+
"renderer": "canvas",
15+
"taintTest": true // do a taint test with all images before applying to canvas
1516
},
1617
queue = [],
1718
canvas,
@@ -81,8 +82,12 @@ html2canvas.Renderer = function(parseQueue, opts){
8182
a,
8283
newCanvas,
8384
bounds,
85+
testCanvas = document.createElement("canvas"),
86+
hasCTX = ( testCanvas.getContext !== undefined ),
8487
storageLen,
8588
renderItem,
89+
testctx = ( hasCTX ) ? testCanvas.getContext("2d") : {},
90+
safeImages = [],
8691
fstyle;
8792

8893
canvas.width = canvas.style.width = (!usingFlashcanvas) ? options.width || zStack.ctx.width : Math.min(flashMaxSize, (options.width || zStack.ctx.width) );
@@ -136,6 +141,21 @@ html2canvas.Renderer = function(parseQueue, opts){
136141
}else if(renderItem.name === "drawImage") {
137142

138143
if (renderItem['arguments'][8] > 0 && renderItem['arguments'][7]){
144+
if ( hasCTX && options.taintTest ) {
145+
if ( safeImages.indexOf( renderItem['arguments'][ 0 ].src ) === -1 ) {
146+
testctx.drawImage( renderItem['arguments'][ 0 ], 0, 0 );
147+
try {
148+
testctx.getImageData( 0, 0, 1, 1 );
149+
} catch(e) {
150+
testCanvas = document.createElement("canvas");
151+
testctx = testCanvas.getContext("2d");
152+
continue;
153+
}
154+
155+
safeImages.push( renderItem['arguments'][ 0 ].src );
156+
157+
}
158+
}
139159
ctx.drawImage.apply( ctx, renderItem['arguments'] );
140160
}
141161
}

‎tests/image.svg‎

Lines changed: 46 additions & 0 deletions
Loading

‎tests/images.html‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,13 @@
6060

6161
<img src="image.jpg" style="width:0px;height:0px;border:1px solid black" />
6262
<img src="image.jpg" style="width:0px;height:0px;" />
63-
63+
6464
<canvas id="testcanvas" style="width:100px;height:100px;"></canvas>
6565
<br />
6666
Image without src attribute, should not crash:
6767
<img style="width:50px;height:50px;border:1px solid red;display:block;" />
6868

69+
SVG taints image:<br /> <!-- http://fi.wikipedia.org/wiki/Tiedosto:Svg.svg -->
70+
<img src="image.svg" />
6971
</body>
7072
</html>

0 commit comments

Comments
 (0)