hixie: Make sure cross-origin fonts can't leak data via <canvas>. (whatwg r5873)

hixie: Make sure cross-origin fonts can't leak data via <canvas>.
(whatwg r5873)

http://dev.w3.org/cvsweb/html5/spec/Overview.html?r1=1.4714&r2=1.4715&f=h
http://html5.org/tools/web-apps-tracker?from=5872&to=5873

===================================================================
RCS file: /sources/public/html5/spec/Overview.html,v
retrieving revision 1.4714
retrieving revision 1.4715
diff -u -d -r1.4714 -r1.4715
--- Overview.html 10 Feb 2011 23:44:32 -0000 1.4714
+++ Overview.html 11 Feb 2011 01:49:03 -0000 1.4715
@@ -343,7 +343,7 @@
 
    <h1>HTML5</h1>
    <h2 class="no-num no-toc" id="a-vocabulary-and-associated-apis-for-html-and-xhtml">A vocabulary and associated APIs for HTML and XHTML</h2>
-   <h2 class="no-num no-toc" id="editor-s-draft-10-february-2011">Editor's Draft 10 February 2011</h2>
+   <h2 class="no-num no-toc" id="editor-s-draft-11-february-2011">Editor's Draft 11 February 2011</h2>
    <dl><dt>Latest Published Version:</dt>
     <dd><a href="http://www.w3.org/TR/html5/">http://www.w3.org/TR/html5/</a></dd>
     <dt>Latest Editor's Draft:</dt>
@@ -478,7 +478,7 @@
   Group</a> is the W3C working group responsible for this
   specification's progress along the W3C Recommendation
   track.
-  This specification is the 10 February 2011 Editor's Draft.
+  This specification is the 11 February 2011 Editor's Draft.
   </p><!-- UNDER NO CIRCUMSTANCES IS THE PRECEDING PARAGRAPH TO BE REMOVED OR EDITED WITHOUT TALKING TO IAN FIRST --><!-- relationship to other work (required) --><p>Work on this specification is also done at the <a href="http://www.whatwg.org/">WHATWG</a>. The W3C HTML working group
   actively pursues convergence with the WHATWG, as required by the <a href="http://www.w3.org/2007/03/HTML-WG-charter">W3C HTML working
   group charter</a>.</p><!-- UNDER NO CIRCUMSTANCES IS THE FOLLOWING PARAGRAPH TO BE REMOVED OR EDITED WITHOUT TALKING TO IAN FIRST --><!-- required patent boilerplate --><p>This document was produced by a group operating under the <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/">5
@@ -26297,6 +26297,12 @@
    <code><a href="#htmlcanvaselement">HTMLCanvasElement</a></code> whose <i>origin-clean</i> flag was
    false when the pattern was created.</li>
 
+   <li><p>The element's 2D context's <code title="dom-context-2d-fillText">fillText()</code> or <code title="dom-context-2d-fillText">strokeText()</code> methods are
+   invoked and end up using a font that has an <a href="#origin">origin</a>
+   that is not the <a href="#same-origin" title="same origin">same</a> as that of
+   the <code><a href="#document">Document</a></code> object that owns the <code><a href="#the-canvas-element">canvas</a></code>
+   element.</li>
+
   </ul><p>Whenever the <code title="dom-canvas-toDataURL"><a href="#dom-canvas-todataurl">toDataURL()</a></code> method of a
   <code><a href="#the-canvas-element">canvas</a></code> element whose <i>origin-clean</i> flag is set to
   false is called, the method must raise a <code><a href="#security_err">SECURITY_ERR</a></code>
@@ -26308,6 +26314,13 @@
   correct arguments, the method must raise a <code><a href="#security_err">SECURITY_ERR</a></code>
   exception.</p>
 
+  <p>Whenever the <code title="dom-context-2d-measureText">measureText()</code> method of
+  the 2D context of a <code><a href="#the-canvas-element">canvas</a></code> element ends up using a font
+  that has an <a href="#origin">origin</a> that is not the <a href="#same-origin" title="same
+  origin">same</a> as that of the <code><a href="#document">Document</a></code> object that
+  owns the <code><a href="#the-canvas-element">canvas</a></code> element, the method must raise a
+  <code><a href="#security_err">SECURITY_ERR</a></code> exception.</p>
+
   <p class="note">Even resetting the canvas state by changing its
   <code title="attr-canvas-width"><a href="#attr-canvas-width">width</a></code> or <code title="attr-canvas-height"><a href="#attr-canvas-height">height</a></code> attributes doesn't reset
   the <i>origin-clean</i> flag.</p>
@@ -43289,6 +43302,21 @@
 
    </dd>
 
+
+   <dt>For fonts</dt>
+
+   <dd>
+
+    <p>The <a href="#origin">origin</a> of a downloadable Web font is equal to
+    the <a href="#origin">origin</a> of the <a href="#absolute-url">absolute URL</a> used to
+    obtain the font (after any redirects). <a href="#refsCSSFONTS">[CSSFONTS]</a></p>
+
+    <p>The <a href="#origin">origin</a> of a locally installed system font is
+    equal to the <a href="#origin">origin</a> of the <code><a href="#document">Document</a></code> in
+    which that font is being used.</p>
+
+   </dd>
+
   </dl><p>Other specifications can override the above definitions by
   themselves specifying the origin of a particular URL, script,
   <code><a href="#document">Document</a></code>, or image.</p>
@@ -70988,6 +71016,10 @@
    Module Level 3</a></cite>, T. &Ccedil;elik, C. Lilley, L.
    Baron. W3C.</dd>
 
+   <dt id="refsCSSFONTS">[CSSFONTS]</dt>
+   <dd><cite><a href="http://www.w3.org/TR/css3-fonts/">CSS Fonts
+   Module Level 3</a></cite>, J. Daggett. W3C.</dd>
+
    <dt id="refsCSSOM">[CSSOM]</dt>
    <dd><cite><a href="http://dev.w3.org/csswg/cssom/">Cascading Style Sheets
    Object Model (CSSOM)</a></cite>, A. van Kesteren. W3C.</dd>

Received on Friday, 11 February 2011 01:50:20 UTC