dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/Libraries
History
sideshowbarker 9f7a328d9b LibWeb: Reject canvas toDataURL()/toBlob() when not origin-clean 
Problem: Drawing a cross-origin image onto a 2D canvas clears its
origin-clean flag, but toDataURL() and toBlob() ignored that flag and
serialized the bitmap regardless. So, a page could read back the
cross-origin pixels it shouldn't (per spec) be allowed to access.

Cause: The origin-clean checks in to_data_url() and to_blob() were left
as FIXMEs. Only getImageData() enforced the flag.

Fix: Throw a SecurityError exception from both serialization entry
points when the canvas isn't origin-clean — matching getImageData() and
the spec. The same check also implements the previously-stubbed
origin-clean step in the WebDriver canvas-encoding algorithm.

Fixes: https://github.com/LadybirdBrowser/ladybird/issues/10009
2026-06-18 10:52:42 +02:00
..
LibCompress LibCompress: Remove PackBitsDecoder 2026-06-12 22:37:49 +02:00
LibCore LibCore: Own addrinfo results without OwnPtr 2026-06-13 22:49:15 +02:00
LibCrypto LibCrypto: Restore cached tag when a failed ASN1 read is rolled back 2026-06-09 08:02:44 +01:00
LibDatabase Meta: Move most dependency checks to check_for_dependencies.cmake 2026-04-20 16:41:29 -06:00
LibDevTools LibDevTools: Allow editing Web Storage 2026-06-11 16:08:33 +01:00
LibDiff CMake: Rename serenity_* helper functions/macros to ladybird_* 2025-07-03 23:19:41 +02:00
LibDNS LibDNS: Serialize answer and authority records in Message::to_raw 2026-06-17 18:27:33 +02:00
LibFileSystem LibFileSystem: Preserve copy flags when recursing into directories 2026-04-13 12:00:52 +02:00
LibGC Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
LibGfx LibGfx+LibWeb: Store Skia images with display list resources 2026-06-17 19:17:10 +02:00
LibHTTP LibHTTP: Treat PSL star-rule domains as public suffixes 2026-06-16 06:14:07 +02:00
LibImageDecoderClient LibImageDecoderClient: Remove sync id fetch from async decode request 2026-02-28 00:04:06 -06:00
LibImageDecoders LibGfx+LibWeb: Remove TIFF image decoding 2026-06-12 22:37:49 +02:00
LibIPC LibIPC: Adopt Mach OOL payloads on receive 2026-06-13 00:27:57 +01:00
LibJS LibJS: Evaluate ToNumber for out-of-bounds typed array writes 2026-06-17 21:24:33 +02:00
LibMain AK: Expose helpers to invoke Windows runtime config directly in main() 2025-10-29 21:07:52 -06:00
LibMedia LibMedia: Don't display video frames that are late 2026-06-11 21:49:55 +02:00
LibRegex LibURL: Implement URLPattern in Rust 2026-05-28 09:27:41 +02:00
LibRequests LibRequests+RequestServer: Send oversized ws frames via shared memory 2026-05-27 09:52:34 +02:00
LibSandbox LibSandbox: Allow TCGETS2 fd queries 2026-06-18 10:25:44 +02:00
LibSync LibSync: Implement ConditionVariable::wait_for(Duration) 2026-05-22 09:30:10 -05:00
LibSyntax LibSyntax+LibJS+LibWebView: Port the syntax highlighter to UTF-8 2026-06-06 18:42:18 +02:00
LibTest LibGC: Defer per-block madvise to a global background worker 2026-05-07 20:09:05 +02:00
LibTextCodec LibJS: Hash encoded source identity in bytecode cache 2026-06-03 14:11:23 +02:00
LibThreading LibThreading: Remove BackgroundAction 2026-06-05 20:00:12 +02:00
LibTLS Meta: Move most dependency checks to check_for_dependencies.cmake 2026-04-20 16:41:29 -06:00
LibUnicode LibUnicode: Remove unused UTF-32 segmenter support 2026-06-06 18:42:18 +02:00
LibURL LibURL: Let Host use PublicSuffixData star rule matching 2026-06-16 06:14:07 +02:00
LibWasm LibWasm: Catch SIGFPE on jitted code too 2026-06-15 16:09:51 +02:00
LibWeb LibWeb: Reject canvas toDataURL()/toBlob() when not origin-clean 2026-06-18 10:52:42 +02:00
LibWebSocket LibWebSocket: Time out stalled close handshakes 2026-05-05 19:14:29 +02:00
LibWebView LibWebView+WebContent: Stop creating GPU Skia backend in WebContent 2026-06-18 10:25:44 +02:00
LibXML Meta: Move most dependency checks to check_for_dependencies.cmake 2026-04-20 16:41:29 -06:00
CMakeLists.txt LibGfx: Split image decoders into a separate library 2026-06-10 11:55:48 +02:00
RustAllocator.rs Rust: Set import granularity to Item 2026-05-28 06:52:18 +02:00