5 ms·
>you can’t directly draw DOM elements to a canvas without awkwardly porting it to an SVG This is not a wart, this is a security feature. Of course, it wouldn't
by creatonez 9y ago
>you can’t directly draw DOM elements to a canvas without awkwardly porting it to an SVG
This is not a wart, this is a security feature. Of course, it wouldn't be a necessary limitation if the web wasn't so complicated, but the web is complicated.
- Jasper_ 9y agoWhat's the security issue in play here?
- creatonez 9y agoJust one example. The canvas API can grab the image data on the canvas. If you could rasterize arbitrary DOM nodes then you could very easily fingerprint users by, say, checking which fonts are installed. You could also load external resources such as images and iframes bypassing same-origin policy, so if your bank's website was configured incorrectly, a malicious site could steal information by taking screenshots of a canvas.
- Jasper_ 9y agoYou can already draw non-same-origin images to the canvas using drawImage. This marks a special "origin-clean" flag which is checked when someone tries to call toDataURI or getImageData on the canvas [0] I would be OK if drawing any DOM node to the canvas cleared the origin-clean flag. [0] https://html.spec.whatwg.org/multipage/canvas.html https://html.spec.whatwg.org/multipage/canvas.html