2009-09-19 Adam Barth <abarth@webkit.org>

[WebKit-https.git] / WebCore / page / SecurityOrigin.cpp

diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 5076adf411e1d84220dfdbc80d6fb103da0a5bc6..b91c1f1976897ca286ce518c08067532bb60f5bb 100644 (file)
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -221,6 +221,22 @@ bool SecurityOrigin::canRequest(const KURL& url) const
     return false;
 }
 
+bool SecurityOrigin::taintsCanvas(const KURL& url) const
+{
+    if (canRequest(url))
+        return false;
+
+    // This method exists because we treat data URLs as noAccess, contrary
+    // to the current (9/19/2009) draft of the HTML5 specification.  We still
+    // want to let folks paint data URLs onto untainted canvases, so we special
+    // case data URLs below.  If we change to match HTML5 w.r.t. data URL
+    // security, then we can remove this method in favor of !canRequest.
+    if (url.protocolIs("data"))
+        return false;
+
+    return true;
+}
+
 void SecurityOrigin::grantLoadLocalResources()
 {
     // This method exists only to support backwards compatibility with older