Re: [mediacapture-fromelement] Deny captureStream for cross-origin media by default from Jun via GitHub on 2018-02-21 (public-media-capture-logs@w3.org from February 2018)

From: Jun via GitHub <sysbot+gh@w3.org>
Date: Wed, 21 Feb 2018 10:53:17 +0000
To: public-media-capture-logs@w3.org
Message-ID: <issue_comment.created-367288724-1519210396-sysbot+gh@w3.org>

This is media stream, so there's no requirement of canvas. It is similar to drawImage, but the [spec](https://w3c.github.io/mediacapture-fromelement/#security-considerations) doesn't have nice concept like "origin-clean falg". So any additional media API that can retrieve data from stream (or streamTrack, and more) would leak the data.

-- 
GitHub Notification of comment by shhnjk
Please view or discuss this issue at https://github.com/w3c/mediacapture-fromelement/issues/70#issuecomment-367288724 using your GitHub account

Received on Wednesday, 21 February 2018 10:53:20 UTC