[whatwg] Fetch SVG images with No CORS tainted cross-origin

[Ian Hickson]

On Tue, 26 Nov 2013, Boris Zbarsky wrote:
> On 11/26/13 5:50 PM, Ian Hickson wrote:
> > > But the image inside this image would also be loaded as basic fetch 
> > > tainted cross origin. Right?
> > 
> > That's up to SVG.
> 
> Note that Gecko has serious security concerns with allowing subresource 
> loads like this in SVG loaded via <img>; we currently disallow them 
> altogether due to those concerns.  Such SVG documents can link to things 
> internal to themselves and to data: URIs, but not to anything requiring 
> network access.
> 
> SVG loaded via <object> is a different story, of course.

The spec currently says:

"User agents must not support non-image resources with the img element 
(e.g. XML files whose root element is an HTML element). User agents must 
not run executable code (e.g. scripts) embedded in the image resource. 
User agents must only display the first page of a multipage resource (e.g. 
a PDF file). User agents must not allow the resource to act in an 
interactive fashion, but should honor any animation in the resource."

I'm happy to add more (e.g. blocking subresources). I'd be even happier to 
do so in a way that explicitly hooks in to some logic on the SVG spec side 
that defines exactly how subresources and scripts are turned off.

Any other implementors agree with Mozilla on this?

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'