← back to v156 · svg-foreignobject-does-not-taint-the-canvas-for-blob-urls
conformance · v156
v156 · svg-foreignobject-does-not-taint-the-canvas-for-blob-urls — conformance probe
6 assertions drawn from the spec. Each is a single contract the spec text makes. Pass/fail reflects what this browser executed; blocked means the contract was not run because it needs user mediation, hardware, or another unavailable precondition. Open the page in Chrome stable / canary / Firefox / Safari to compare.
0
pass
0
fail
0
blocked
6
total
| id | contract | kind | verdict | detail |
|---|---|---|---|---|
createobjecturl-available |
URL.createObjectURL is how a page turns its own bytes into a loadable URL; the whole feature is about what happens when one of those is drawn to a canvas. spec ↗ | typeof | … | |
getimagedata-available |
getImageData is the readback operation the tainting rule guards. spec ↗ | typeof | … | |
blob-foreignobject-does-not-taint |
Drawing an SVG that contains a foreignObject from a blob: URL must leave the canvas readable. Before Chrome 156 getImageData() threw SecurityError here, while the identical markup delivered as a data: URI did not. spec ↗ | script | … | |
data-foreignobject-does-not-taint |
The data: URI case has always been clean in every engine. It is the control: if this fails, the harness is broken rather than the browser. spec ↗ | script | … | |
blob-plain-svg-does-not-taint |
A blob: SVG with no foreignObject must be clean regardless of this change, which separates the URL scheme from the foreign-content rule. spec ↗ | script | … | |
blob-foreignobject-canvas-is-exportable |
Readback and export share the origin-clean check, so a canvas drawn from a blob: foreignObject must also export. This is the operation authors actually hit, since a screenshot library ends at toDataURL or toBlob. spec ↗ | script | … |