Skip to content

Commit d02ad9f

Browse files
committed
Fix expected results for video loading from multiple origins
See whatwg/html#7655 When loading video from multiple opaque origins (by a middleman service-worker), video loading should fail rather than be alllowed and taint the canvas. That's because some of the video responses may contain metadata such as duration that would leak to the subsequent requests. See whatwg/html#2814 (comment) for further details. This change makes the test case pass in all browsers.
1 parent 7c61a45 commit d02ad9f

1 file changed

Lines changed: 3 additions & 4 deletions

File tree

service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,11 @@
6363

6464
// (3) Range responses come from multiple origins. The first response comes from
6565
// cross-origin (and without CORS sharing, so is opaque). Subsequent
66-
// responses come from same-origin. The canvas should be tainted (but in
67-
// Chrome this is a LOAD_ERROR since it disallows range responses from
68-
// multiple origins, period).
66+
// responses come from same-origin. This should result in a load error, as regardless of canvas
67+
// loading range requests from multiple opaque origins can reveal information across those origins.
6968
range_request_test(
7069
'resources/range-request-to-different-origins-worker.js',
71-
'TAINTED',
70+
'LOAD_ERROR',
7271
'range responses from multiple origins (cross-origin first)');
7372

7473
// (4) Range responses come from multiple origins. The first response comes from

0 commit comments

Comments
 (0)