There's a browser feature called "tainted canvas", which throws a SecurityError if any of the content came from external sources.
From https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabl...
> Because the pixels in a canvas's bitmap can come from a variety of sources, including images or videos retrieved from other hosts, it's inevitable that security problems may arise.
> As soon as you draw into a canvas any data that was loaded from another origin without CORS approval, the canvas becomes tainted. A tainted canvas is one which is no longer considered secure, and any attempts to retrieve image data back from the canvas will cause an exception to be thrown.
To get around this, the Pico library includes a (big) list of workarounds, to download and inline images, stylesheets, etc. Then:
> The returned DOM is inserted into an <iframe>, serialized into XML, converted into a data URL, put into an Image, which is then rendered onto a <canvas>.
I do wonder though, couldn't the same techniques be used by a malicious script to also get around the "tainted canvas" issue..?
