Bug 1869202 - taint filter if input is currentColor r=emilio

See https://www.w3.org/TR/filter-effects-1/#tainted-filter-primitives

Differential Revision: https://phabricator.services.mozilla.com/D195996

dom/svg/SVGFEDropShadowElement.cpp

@@ -88,8 +88,7 @@ FilterPrimitiveDescription SVGFEDropShadowElement::GetPrimitiveDescription(
   atts.mStdDeviation = Size(stdX, stdY);
   atts.mOffset = offset;
 
-  nsIFrame* frame = GetPrimaryFrame();
+  if (const auto* frame = GetPrimaryFrame()) {
-  if (frame) {
     const nsStyleSVGReset* styleSVGReset = frame->Style()->StyleSVGReset();
     sRGBColor color(
         sRGBColor::FromABGR(styleSVGReset->mFloodColor.CalcColor(frame)));
@@ -101,6 +100,19 @@ FilterPrimitiveDescription SVGFEDropShadowElement::GetPrimitiveDescription(
   return FilterPrimitiveDescription(AsVariant(std::move(atts)));
 }
 
+bool SVGFEDropShadowElement::OutputIsTainted(
+    const nsTArray<bool>& aInputsAreTainted,
+    nsIPrincipal* aReferencePrincipal) {
+  if (const auto* frame = GetPrimaryFrame()) {
+    if (frame->Style()->StyleSVGReset()->mFloodColor.IsCurrentColor()) {
+      return true;
+    }
+  }
+
+  return SVGFEDropShadowElementBase::OutputIsTainted(aInputsAreTainted,
+                                                     aReferencePrincipal);
+}
+
 bool SVGFEDropShadowElement::AttributeAffectsRendering(
     int32_t aNameSpaceID, nsAtom* aAttribute) const {
   return SVGFEDropShadowElementBase::AttributeAffectsRendering(aNameSpaceID,

dom/svg/SVGFEDropShadowElement.h

@@ -41,6 +41,10 @@ class SVGFEDropShadowElement final : public SVGFEDropShadowElementBase {
   SVGAnimatedString& GetResultImageName() override {
     return mStringAttributes[RESULT];
   }
+
+  bool OutputIsTainted(const nsTArray<bool>& aInputsAreTainted,
+                       nsIPrincipal* aReferencePrincipal) override;
+
   void GetSourceImageNames(nsTArray<SVGStringInfo>& aSources) override;
 
   // nsIContent interface

dom/svg/SVGFEFloodElement.cpp

@@ -37,8 +37,7 @@ FilterPrimitiveDescription SVGFEFloodElement::GetPrimitiveDescription(
     const nsTArray<bool>& aInputsAreTainted,
     nsTArray<RefPtr<SourceSurface>>& aInputImages) {
   FloodAttributes atts;
-  nsIFrame* frame = GetPrimaryFrame();
+  if (const auto* frame = GetPrimaryFrame()) {
-  if (frame) {
     const nsStyleSVGReset* styleSVGReset = frame->Style()->StyleSVGReset();
     sRGBColor color(
         sRGBColor::FromABGR(styleSVGReset->mFloodColor.CalcColor(frame)));
@@ -50,6 +49,18 @@ FilterPrimitiveDescription SVGFEFloodElement::GetPrimitiveDescription(
   return FilterPrimitiveDescription(AsVariant(std::move(atts)));
 }
 
+bool SVGFEFloodElement::OutputIsTainted(const nsTArray<bool>& aInputsAreTainted,
+                                        nsIPrincipal* aReferencePrincipal) {
+  if (const auto* frame = GetPrimaryFrame()) {
+    if (frame->Style()->StyleSVGReset()->mFloodColor.IsCurrentColor()) {
+      return true;
+    }
+  }
+
+  return SVGFEFloodElementBase::OutputIsTainted(aInputsAreTainted,
+                                                aReferencePrincipal);
+}
+
 //----------------------------------------------------------------------
 // nsIContent methods
 

dom/svg/SVGFEFloodElement.h

@@ -38,6 +38,9 @@ class SVGFEFloodElement final : public SVGFEFloodElementBase {
     return mStringAttributes[RESULT];
   }
 
+  bool OutputIsTainted(const nsTArray<bool>& aInputsAreTainted,
+                       nsIPrincipal* aReferencePrincipal) override;
+
   // nsIContent interface
   nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 

dom/svg/SVGFilters.cpp

@@ -365,7 +365,7 @@ LightType SVGFELightingElement::ComputeLightAttributes(
 bool SVGFELightingElement::AddLightingAttributes(
     mozilla::gfx::DiffuseLightingAttributes* aAttributes,
     SVGFilterInstance* aInstance) {
-  nsIFrame* frame = GetPrimaryFrame();
+  const auto* frame = GetPrimaryFrame();
   if (!frame) {
     return false;
   }
@@ -394,6 +394,19 @@ bool SVGFELightingElement::AddLightingAttributes(
   return true;
 }
 
+bool SVGFELightingElement::OutputIsTainted(
+    const nsTArray<bool>& aInputsAreTainted,
+    nsIPrincipal* aReferencePrincipal) {
+  if (const auto* frame = GetPrimaryFrame()) {
+    if (frame->Style()->StyleSVGReset()->mLightingColor.IsCurrentColor()) {
+      return true;
+    }
+  }
+
+  return SVGFELightingElementBase::OutputIsTainted(aInputsAreTainted,
+                                                   aReferencePrincipal);
+}
+
 bool SVGFELightingElement::AttributeAffectsRendering(int32_t aNameSpaceID,
                                                      nsAtom* aAttribute) const {
   return SVGFELightingElementBase::AttributeAffectsRendering(aNameSpaceID,

dom/svg/SVGFilters.h

@@ -184,6 +184,10 @@ class SVGFELightingElement : public SVGFELightingElementBase {
   SVGAnimatedString& GetResultImageName() override {
     return mStringAttributes[RESULT];
   }
+
+  bool OutputIsTainted(const nsTArray<bool>& aInputsAreTainted,
+                       nsIPrincipal* aReferencePrincipal) override;
+
   void GetSourceImageNames(nsTArray<SVGStringInfo>& aSources) override;
 
  protected:

testing/web-platform/meta/css/filter-effects/tainting-feblend-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-feblend-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fecomponenttransfer-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fecomponenttransfer-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fecomposite-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fecomposite-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-feconvolvematrix-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-feconvolvematrix-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fediffuselighting-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fediffuselighting-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fediffuselighting-003.html.ini

@@ -1,2 +0,0 @@
-[tainting-fediffuselighting-003.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fediffuselighting-dynamic.html.ini

@@ -1,2 +0,0 @@
-[tainting-fediffuselighting-dynamic.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fedisplacementmap-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fedisplacementmap-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fedropshadow-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fedropshadow-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fedropshadow-003.html.ini

@@ -1,2 +0,0 @@
-[tainting-fedropshadow-003.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-feflood-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-feflood-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-feflood-dynamic.html.ini

@@ -1,2 +0,0 @@
-[tainting-feflood-dynamic.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fegaussianblur-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fegaussianblur-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-femorphology-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-femorphology-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-feoffset-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-feoffset-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fespecularlighting-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fespecularlighting-002.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fespecularlighting-003.html.ini

@@ -1,2 +0,0 @@
-[tainting-fespecularlighting-003.html]
-  expected: FAIL

testing/web-platform/meta/css/filter-effects/tainting-fetile-002.html.ini

@@ -1,2 +0,0 @@
-[tainting-fetile-002.html]
-  expected: FAIL