Comments on: Detect if the browser supports APNG

By: PacoBell

PacoBell — Thu, 19 Mar 2009 06:03:08 +0000

Huh, that seems kind of a roundabout way of detecting APNG support. A more surefire way seems to be this: http://foone.org/apng/

By: cromwellian

cromwellian — Thu, 05 Mar 2009 23:56:20 +0000

I don’t see how banning dataURI imports into Canvas changes the security dynamics, since I can parse a dataURI in Javascript, compute the pixel data, and rasterize it into the Canvas using normal draw operations (e.g. fillRect)

For example, if I was doing an XSS attack against you, by retrieving a GIF from a domain you were logged into which contains you bank account credentials embedded in the image, then it makes sense to mark the canvas dirty with cross domain images. However, if I were to instead, somehow retrieve a dataURI from the XSS site, there is nothing you could do to stop me. I wouldn’t even need to use the Canvas, the mere position of the dataURI is enough. I could then post it to any URL I own and decode it locally on my desktop.

The banning of dataURIs seems like security through obscurity.

By: MrMoo

MrMoo — Thu, 05 Mar 2009 16:12:44 +0000

Aah. I interpreted that as Alpha PNGs – as in 32-bit PNGs. I didn’t even think of Animated PNGs. My bad, and you have my apologies. I still think that tossing an error in IE is bad.

By: EliGrey

EliGrey — Thu, 05 Mar 2009 11:54:12 +0000

@MrMoo APNG is animated PNG. IE does not support anything of the sort.
As of yet, there are no browsers that support APNG and not canvas so no worries.

By: MrMoo

MrMoo — Thu, 05 Mar 2009 09:28:22 +0000

And by transparency I mean opacity. And by opacity, in IE, I mean the Alpha filter. Which inevitably ends with using the AlphaImageLoader filter, so perhaps “supports” is too strong a word.

By: MrMoo

MrMoo — Thu, 05 Mar 2009 05:38:24 +0000

My point was that in browsers that don’t support canvas (IE) the code will throw an error. IE7 “supports” 32-bit PNGs but not canvas (I say “supports” because as soon as you apply any kind of transparency on them things get nasty).

By: GlenLipka

GlenLipka — Thu, 05 Mar 2009 01:50:08 +0000

Sorry, my bad. Was reading a bit too quickly.

By: EliGrey

EliGrey — Thu, 05 Mar 2009 01:42:31 +0000

@GlenLipka RTFA, this has nothing to do with IE6. Not even IE8 supports this.

By: GlenLipka

GlenLipka — Thu, 05 Mar 2009 00:39:43 +0000

You dont need to do this at all. Just create PNG-8 files that degrade well in IE6.
http://commadot.com/png-8-that-acts-like-png-24-without-fireworks/

By: 0x336699

0x336699 — Wed, 04 Mar 2009 19:17:59 +0000

Is the assumption that a browser that doesn’t support canvas also doesn’t support APNG? Because that’s just wrong.

No. The code (and inline comments) suggest that you use the canvas to detect whether or not the browser supports APNGs. By testing the color of a particular pixel at a particular time, you can detect if the image moved to the second frame or not.

By: MrMoo

MrMoo — Wed, 04 Mar 2009 15:24:54 +0000

Is the assumption that a browser that doesn’t support canvas also doesn’t support APNG? Because that’s just wrong.

By: Joeri

Joeri — Wed, 04 Mar 2009 14:55:23 +0000

@p01: Do you have any link for that? Or perhaps a more elaborate explanation?

By: p01

p01 — Wed, 04 Mar 2009 13:17:21 +0000

The security violation raised when trying to import a data URI image into a Canvas may be annoying but it is not a stupid restriction. It is a necessary security and privacy measure.