Skip to content

Commit

Permalink
Fix expected results for video loading from multiple origins
Browse files Browse the repository at this point in the history
See whatwg/html#7655

When loading video from multiple opaque origins (by a middleman service-worker),
video loading should fail rather than be alllowed and taint the canvas.

That's because some of the video responses may contain metadata such as duration that
would leak to the subsequent requests.

See whatwg/html#2814 (comment) for further details.

This change makes the test case pass in all browsers.
  • Loading branch information
noamr committed Mar 24, 2022
1 parent 7c61a45 commit d02ad9f
Showing 1 changed file with 3 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -63,12 +63,11 @@

// (3) Range responses come from multiple origins. The first response comes from
// cross-origin (and without CORS sharing, so is opaque). Subsequent
// responses come from same-origin. The canvas should be tainted (but in
// Chrome this is a LOAD_ERROR since it disallows range responses from
// multiple origins, period).
// responses come from same-origin. This should result in a load error, as regardless of canvas
// loading range requests from multiple opaque origins can reveal information across those origins.
range_request_test(
'resources/range-request-to-different-origins-worker.js',
'TAINTED',
'LOAD_ERROR',
'range responses from multiple origins (cross-origin first)');

// (4) Range responses come from multiple origins. The first response comes from
Expand Down

0 comments on commit d02ad9f

Please sign in to comment.