Path: csiph.com!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: Read binary file
Supersedes: <2825089.MJb5xlsoic@PointedEars.de>
Date: Thu, 17 Mar 2016 21:43:50 +0100
Organization: PointedEars Software (PES)
Lines: 48
Message-ID: <6005521.MME42bj82n@PointedEars.de>
References: <nccmg2$kq7$1@gioia.aioe.org> <145821661.4prVZSFEgG@PointedEars.de> <ncdmil$1ser$1@gioia.aioe.org> <2237637.9AE1fihV9u@PointedEars.de> <nceuqd$756$1@news.albasani.net>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1458247430 24225 eJwFwYkBgDAIA8CVgJLEjqM8+4/gHQ6dpSSYWGyPOK+2fWquwh3ooIVVWCpO2jTuQPY9Lv8BHqEQag== (17 Mar 2016 20:43:50 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Thu, 17 Mar 2016 20:43:50 +0000 (UTC)
User-Agent: KNode/4.14.2
Cancel-Key: sha1:Kgrywb9kZuF39Bs9dA8n1ihK3TA=
X-User-ID: eJwFwYEBwCAIA7CXQFuUcyiO/09Ywh0efRAMcDiu+dAq2LU8o0Slp+7phVe2V0UYxAXG2Kh5v5d6aqOf5A9axRWP
Cancel-Lock: sha1:l0JYr2rzfolCM73gJ7Erl1rQddE=
X-NNTP-Posting-Host: eJwFwQkBwDAIA0BLfAkgpy3Dv4Tdwal8GQQDizWFQG+srVvdgoihfWbIWWfLgRc718/Lr3/+ThBN
Xref: csiph.com comp.lang.javascript:30039

Stefan Weiss wrote:

> Thomas 'PointedEars' Lahn wrote:
>> Herbert Kleebauer wrote:
>>> Suppose the Server B provides this information:
>>> "download the picture http://ikomi.de/test/1.jpg and
>>> increase brightness by 10% and decrease contrast by 5%".
> [...]
> 
>> The Canvas API appears to be what you are looking for:
>> 
>> <https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API/Tutorial/Pixel_manipulation_with_canvas>
>> 
>> (CORS obviously cannot help you there as you do not control the server of
>> the original work.)
> 
> As I mentioned earlier, this does not work cross-origin without CORS.

Indeed.  The Canvas tutorial should be updated with that information.

> Adding image data from server A to the canvas will taint it, preventing
> data extraction and manipulation.

Yes, but:

The Same Origin Policy (SOP) does not depend on the server; it depends on 
protocol and domain names, and port numbers.

Therefore:

> >>> I know how (it is actually trivial if you think it through),
> > (JFTR: Canvas is not what I meant with this.  I had not thought of that 
> > possibility at the time.)
> 
> So, now that the copyright situation has been explained, what's the
> trivial solution?

Transparent HTTP proxying with mod_rewrite, mod_proxy, mod_proxy_http & 
friends.  If the Web browser does not know that a resource has a different 
origin, the SOP does not apply.  WFM with Apache/2.4.18 (Debian) in Chromium 
“46.0.2490.71 Built on 8.2, running on Debian stretch/sid (64-bit)” (which 
would without proxying and CORS block access precisely as you described).

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.