From eb2cbc0600c148e761f9dbd9ff191cf20576d6ff Mon Sep 17 00:00:00 2001
From: Stephen Chenney <schenney@chromium.org>
Date: Fri, 25 Sep 2026 20:00:30 -0700
Subject: [PATCH] [HiC] Disallow external SVG content referenced by href

Several SVG elements support href attributes to obtain the
implementation of the element from a template. When the
referencing element is inside the canvas subtree, and the
referenced element is outside we must disallow the outer
element because it does not have privacy protections in
place for style-based privacy control, such as visited link
color.

Fix the problem for <pattern>, <linearGradient> and <radialGradient>
and add tests. Other elements that support this form of referencing
have been audited. A test has been added for chained <use> elements,
which is not a problem due to the implementation of <use> cloning
the external content into the subtree. The <set> element uses the
attribute changed pathway so changes to href through that mechanism
are also protected.

Finally, the number of SVG privacy tests is large enough to justify
moving them to a sub-directory.

Fixed: 553147154
Change-Id: I91d780134a32454ef4fb1adf7c03548a3a54dc23
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8455562
Commit-Queue: Stephen Chenney <schenney@chromium.org>
Reviewed-by: Stefan Zager <szager@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1705420}
---
diff --git a/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc b/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc
index a831ec9..78c0d27 100644
--- a/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc
@@ -111,6 +111,7 @@
 
   VisitedSet visited;
   const SVGGradientElement* current = this;
+  bool is_in_canvas_subtree = IsInCanvasSubtree();
 
   LinearGradientAttributes attributes;
   while (true) {
@@ -120,12 +121,17 @@
 
     current = current->ReferencedElement();
 
-    // Ignore the referenced gradient element if it is not attached.
-    if (!current || !current->GetLayoutObject())
+    // Ignore the referenced gradient element if it is not attached or if we
+    // are following a reference chain that started inside the canvas subtree
+    // and an element outside the subtree is found.
+    if (!current || !current->GetLayoutObject() ||
+        (is_in_canvas_subtree && !current->IsInCanvasSubtree())) {
       break;
+    }
     // Cycle detection.
-    if (visited.Contains(current))
+    if (visited.Contains(current)) {
       break;
+    }
   }
 
   // Fill out any ("complex") empty fields with values from this element (where
diff --git a/third_party/blink/renderer/core/svg/svg_pattern_element.cc b/third_party/blink/renderer/core/svg/svg_pattern_element.cc
index 14e9650..605269a4 100644
--- a/third_party/blink/renderer/core/svg/svg_pattern_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_pattern_element.cc
@@ -224,6 +224,7 @@
 PatternAttributes SVGPatternElement::CollectPatternAttributes() const {
   HeapHashSet<Member<const SVGPatternElement>> processed_patterns;
   const SVGPatternElement* current = this;
+  bool is_in_canvas_subtree = IsInCanvasSubtree();
 
   PatternAttributes attributes;
   while (true) {
@@ -234,12 +235,17 @@
     // from that element to override values this pattern didn't set.
     current = current->ReferencedElement();
 
-    // Ignore the referenced pattern element if it is not attached.
-    if (!current || !current->GetLayoutObject())
+    // Ignore the referenced pattern element if it is not attached or if we
+    // are following a reference chain that started inside the canvas subtree
+    // and an element outside the subtree is found.
+    if (!current || !current->GetLayoutObject() ||
+        (is_in_canvas_subtree && !current->IsInCanvasSubtree())) {
       break;
+    }
     // Cycle detection.
-    if (processed_patterns.Contains(current))
+    if (processed_patterns.Contains(current)) {
       break;
+    }
   }
 
   // Fill out any ("complex") empty fields with values from this element (where
diff --git a/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc b/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc
index 3f03182e..d5e57da 100644
--- a/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc
@@ -129,6 +129,7 @@
 
   VisitedSet visited;
   const SVGGradientElement* current = this;
+  bool is_in_canvas_subtree = IsInCanvasSubtree();
 
   RadialGradientAttributes attributes;
   while (true) {
@@ -137,9 +138,13 @@
     visited.insert(current);
 
     current = current->ReferencedElement();
-    // Ignore the referenced gradient element if it is not attached.
-    if (!current || !current->GetLayoutObject())
+    // Ignore the referenced gradient element if it is not attached or if we
+    // are following a reference chain that started inside the canvas subtree
+    // and an element outside the subtree is found.
+    if (!current || !current->GetLayoutObject() ||
+        (is_in_canvas_subtree && !current->IsInCanvasSubtree())) {
       break;
+    }
     // Cycle detection.
     if (visited.Contains(current))
       break;
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-images-ignored.tentative.https.sub.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-images-ignored.tentative.https.sub.html
deleted file mode 100644
index 0f7fad9..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-images-ignored.tentative.https.sub.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>drawElementImage does not draw cross-origin SVG images</title>
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src='/html/canvas/resources/canvas-tests.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-<body>
-  <canvas id=canvas width="100" height="200" content=drawable>
-    <svg id=child width=100 height=200>
-      <rect fill="green" x=0 y=0 width=100 height=200 />
-      <image id="sameOrigin" href="https://{{location[host]}}/images/red-100x100.png" x=10 y=10 height=100 width=100 />
-      <image id="crossOrigin" href="https://{{hosts[alt][www]}}:{{ports[https][0]}}/images/red-100x100.png" x=0 y=100 height=100 width=100 />
-    </svg>
-  </canvas>
-
-  <script>
-    window.onload = function() {
-      promise_test(async function(t) {
-        await waitForCanvasPaint(canvas);
-        const context = canvas.getContext("2d");
-        context.drawElementImage(child, 0, 0);
-
-        // Fetch all pixel data once to avoid multiple slow readbacks.
-        const imgData = context.getImageData(0, 0, canvas.width, canvas.height);
-
-        let pixel = _getPixelFromImageData(imgData, 50, 50);
-        assert_array_equals(pixel, [255, 0, 0, 255], "Same origin should draw");
-
-        pixel = _getPixelFromImageData(imgData, 50, 150);
-        assert_array_equals(pixel, [0, 128, 0, 255], "Cross origin should not draw");
-      });
-    };
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-linear-gradient-outside-subtree-ignored.tentative.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-linear-gradient-outside-subtree-ignored.tentative.html
deleted file mode 100644
index 38f4128d..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-linear-gradient-outside-subtree-ignored.tentative.html
+++ /dev/null
@@ -1,62 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>drawElementImage does not use SVG resources from outside the subtree</title>
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-  <style>
-    a {
-      color: blue;
-    }
-    a:visited {
-      color: red;
-    }
-    canvas {
-      background-color: green;
-    }
-  </style>
-</head>
-<body>
-  <a href="">
-    <svg width="0" height="0">
-      <defs>
-        <linearGradient id="grad-outside">
-          <stop offset="0" stop-color="currentColor"/>
-          <stop offset="1" stop-color="currentColor"/>
-        </linearGradient>
-      </defs>
-    </svg>
-  </a>
-
-  <canvas id="canvas" width="100" height="100" content=drawable>
-    <div id="child">
-      <svg width="100" height="100">
-        <rect x="0" y="0" width="100" height="100" fill="url(#grad-outside)"/>
-      </svg>
-    </div>
-  </canvas>
-
-  <script>
-    window.onload = () => {
-      promise_test(async function(t) {
-        await waitForCanvasPaint(canvas);
-
-        var context = canvas.getContext("2d");
-
-        context.fillStyle = 'green';
-        context.fillRect(0, 0, 100, 100);
-
-        // Draw the element image
-        context.drawElementImage(child, 0, 0);
-
-        // The canvas should ignore the gradient and use transparent black.
-        let pixel = context.getImageData(50, 50, 1, 1).data;
-        assert_false(pixel[0] > 0, "The canvas should not use the gradient.");
-        assert_true(pixel[1] > 0, "The canvas should not use the gradient.");
-        assert_false(pixel[2] > 0, "The canvas should not use the gradient.");
-      });
-    };
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-marker-outside-subtree-ignored.tentative.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-marker-outside-subtree-ignored.tentative.html
deleted file mode 100644
index dde36224..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-marker-outside-subtree-ignored.tentative.html
+++ /dev/null
@@ -1,82 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>drawElementImage does not use SVG markers outside the subtree</title>
-  <link rel="help" href="https://github.com/WICG/html-in-canvas">
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src='/html/canvas/resources/canvas-tests.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-<body>
-  <svg width="0" height="0">
-    <defs>
-      <marker id="markerOut" markerUnits="userSpaceOnUse" viewBox="0 0 100 100" markerWidth="20" markerHeight="20" refX="50" refY="50">
-        <image href="/images/red-100x100.png" x="0" y="0" width="100" height="100" preserveAspectRatio="none"/>
-      </marker>
-    </defs>
-  </svg>
-
-  <canvas id="canvas" width="100" height="100" content=drawable>
-    <svg id=child width="100" height="100">
-      <marker id="markerIn" markerUnits="userSpaceOnUse" viewBox="0 0 100 100" markerWidth="20" markerHeight="20" refX="50" refY="50">
-        <image href="/images/green-100x100.png" x="0" y="0" width="100" height="100" preserveAspectRatio="none"/>
-      </marker>
-      <path d="M 20 20 L 50 20 L 80 20"
-        stroke="black"
-        marker-start="url(#markerOut)"
-        marker-mid="url(#markerOut)"
-        marker-end="url(#markerOut)" />
-      <path d="M 20 40 L 50 40 L 80 40"
-        stroke="black"
-        marker-start="url(#markerIn)"
-        marker-mid="url(#markerIn)"
-        marker-end="url(#markerIn)" />
-    </svg>
-  </canvas>
-
-  <script>
-    window.onload = () => {
-      promise_test(async function(t) {
-        const preloadImage = (url) => new Promise((resolve, reject) => {
-          const img = new Image();
-          img.onload = () => resolve(img);
-          img.onerror = () => reject(new Error(`Failed to load image: ${url}`));
-          img.src = url;
-        });
-
-        const imageEl1 = document.querySelector('#markerOut image');
-        const imageEl2 = document.querySelector('#markerIn image');
-        await Promise.all([
-          preloadImage(imageEl1.getAttribute('href')),
-          preloadImage(imageEl2.getAttribute('href')),
-        ]);
-
-        await waitForCanvasPaint(canvas);
-        var ctx = canvas.getContext('2d');
-        ctx.fillStyle = 'white';
-        ctx.fillRect(0, 0, 100, 100);
-        ctx.drawElementImage(child, 0, 0);
-
-        // The canvas should ignore the marker and draw the line black.
-        // Fetch all pixel data once to avoid multiple slow readbacks.
-        const imgData = ctx.getImageData(0, 0, canvas.width, canvas.height);
-
-        let pixel = _getPixelFromImageData(imgData, 15, 25);
-        assert_array_equals(pixel, [255, 255, 255, 255], "External start marker should not draw");
-        pixel = _getPixelFromImageData(imgData, 45, 25);
-        assert_array_equals(pixel, [255, 255, 255, 255], "External mid marker should not draw");
-        pixel = _getPixelFromImageData(imgData, 85, 25);
-        assert_array_equals(pixel, [255, 255, 255, 255], "External end marker should not draw");
-
-        pixel = _getPixelFromImageData(imgData, 15, 45);
-        assert_array_equals(pixel, [0, 255, 0, 255], "Internal start marker should draw");
-        pixel = _getPixelFromImageData(imgData, 45, 45);
-        assert_array_equals(pixel, [0, 255, 0, 255], "Internal mid marker should draw");
-        pixel = _getPixelFromImageData(imgData, 85, 45);
-        assert_array_equals(pixel, [0, 255, 0, 255], "Internal end marker should draw");
-      });
-    }
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-filter.tentative.https.sub.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-filter.tentative.https.sub.html
deleted file mode 100644
index 768caff..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-filter.tentative.https.sub.html
+++ /dev/null
@@ -1,74 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>drawElementImage does not use cross-origin feImages on filtered SVG text inside masks</title>
-  <link rel="help" href="https://github.com/WICG/html-in-canvas">
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src='/html/canvas/resources/canvas-tests.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-
-<body>
-  <svg width="0" height="0">
-    <defs>
-      <filter id="filter-same" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-        <feImage href="https://{{location[host]}}/images/green-100x100.png"/>
-        <feComponentTransfer>
-          <feFuncR type="linear" slope="0" intercept="1"/>
-          <feFuncG type="linear" slope="0" intercept="1"/>
-          <feFuncB type="linear" slope="0" intercept="1"/>
-        </feComponentTransfer>
-      </filter>
-      <filter id="filter-cross" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-        <feImage href="https://{{hosts[alt][www]}}:{{ports[https][0]}}/images/red-100x100.png"/>
-        <feComponentTransfer>
-          <feFuncR type="linear" slope="0" intercept="1"/>
-          <feFuncG type="linear" slope="0" intercept="1"/>
-          <feFuncB type="linear" slope="0" intercept="1"/>
-        </feComponentTransfer>
-      </filter>
-      <mask id="mask-cross" maskUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-        <text x="0" y="50" filter="url(#filter-cross)">x</text>
-      </mask>
-    </defs>
-  </svg>
-
-  <canvas id="canvas" width="100" height="200" content=drawable>
-    <svg id="child" width="100" height="200">
-      <defs>
-        <mask id="mask-same" maskUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-          <text x="0" y="50" filter="url(#filter-same)">x</text>
-        </mask>
-      </defs>
-      <svg x="0" y="0" width="100" height="100">
-        <rect width="100" height="100" fill="rgb(30, 130, 230)" mask="url(#mask-same)"/>
-      </svg>
-      <svg x="0" y="100" width="100" height="100">
-        <rect width="100" height="100" fill="rgb(40, 140, 240)" mask="url(#mask-cross)"/>
-      </svg>
-    </svg>
-  </canvas>
-
-  <script>
-    window.onload = () => {
-      promise_test(async function(t) {
-        await waitForCanvasPaint(canvas);
-        var ctx = canvas.getContext('2d');
-        ctx.fillStyle = 'blue';
-        ctx.fillRect(0, 0, 100, 200);
-        ctx.drawElementImage(document.getElementById('child'), 0, 0);
-
-        // Fetch all pixel data once to avoid multiple slow readbacks.
-        const imgData = ctx.getImageData(0, 0, canvas.width, canvas.height);
-
-        let pixel = _getPixelFromImageData(imgData, 50, 50);
-        assert_array_equals(pixel, [30, 130, 230, 255], "Same origin filter image in internal mask should be drawn");
-
-        pixel = _getPixelFromImageData(imgData, 50, 150);
-        assert_array_equals(pixel, [0, 0, 255, 255], "Cross origin filter image in external mask should not be drawn");
... (file diff truncated)

diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-images-ignored.tentative.https.sub.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-images-ignored.tentative.https.sub.html
deleted file mode 100644
index 0f7fad9..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-images-ignored.tentative.https.sub.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>drawElementImage does not draw cross-origin SVG images</title>
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src='/html/canvas/resources/canvas-tests.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-<body>
-  <canvas id=canvas width="100" height="200" content=drawable>
-    <svg id=child width=100 height=200>
-      <rect fill="green" x=0 y=0 width=100 height=200 />
-      <image id="sameOrigin" href="https://{{location[host]}}/images/red-100x100.png" x=10 y=10 height=100 width=100 />
-      <image id="crossOrigin" href="https://{{hosts[alt][www]}}:{{ports[https][0]}}/images/red-100x100.png" x=0 y=100 height=100 width=100 />
-    </svg>
-  </canvas>
-
-  <script>
-    window.onload = function() {
-      promise_test(async function(t) {
-        await waitForCanvasPaint(canvas);
-        const context = canvas.getContext("2d");
-        context.drawElementImage(child, 0, 0);
-
-        // Fetch all pixel data once to avoid multiple slow readbacks.
-        const imgData = context.getImageData(0, 0, canvas.width, canvas.height);
-
-        let pixel = _getPixelFromImageData(imgData, 50, 50);
-        assert_array_equals(pixel, [255, 0, 0, 255], "Same origin should draw");
-
-        pixel = _getPixelFromImageData(imgData, 50, 150);
-        assert_array_equals(pixel, [0, 128, 0, 255], "Cross origin should not draw");
-      });
-    };
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-linear-gradient-outside-subtree-ignored.tentative.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-linear-gradient-outside-subtree-ignored.tentative.html
deleted file mode 100644
index 38f4128d..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-linear-gradient-outside-subtree-ignored.tentative.html
+++ /dev/null
@@ -1,62 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>drawElementImage does not use SVG resources from outside the subtree</title>
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-  <style>
-    a {
-      color: blue;
-    }
-    a:visited {
-      color: red;
-    }
-    canvas {
-      background-color: green;
-    }
-  </style>
-</head>
-<body>
-  <a href="">
-    <svg width="0" height="0">
-      <defs>
-        <linearGradient id="grad-outside">
-          <stop offset="0" stop-color="currentColor"/>
-          <stop offset="1" stop-color="currentColor"/>
-        </linearGradient>
-      </defs>
-    </svg>
-  </a>
-
-  <canvas id="canvas" width="100" height="100" content=drawable>
-    <div id="child">
-      <svg width="100" height="100">
-        <rect x="0" y="0" width="100" height="100" fill="url(#grad-outside)"/>
-      </svg>
-    </div>
-  </canvas>
-
-  <script>
-    window.onload = () => {
-      promise_test(async function(t) {
-        await waitForCanvasPaint(canvas);
-
-        var context = canvas.getContext("2d");
-
-        context.fillStyle = 'green';
-        context.fillRect(0, 0, 100, 100);
-
-        // Draw the element image
-        context.drawElementImage(child, 0, 0);
-
-        // The canvas should ignore the gradient and use transparent black.
-        let pixel = context.getImageData(50, 50, 1, 1).data;
-        assert_false(pixel[0] > 0, "The canvas should not use the gradient.");
-        assert_true(pixel[1] > 0, "The canvas should not use the gradient.");
-        assert_false(pixel[2] > 0, "The canvas should not use the gradient.");
-      });
-    };
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-marker-outside-subtree-ignored.tentative.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-marker-outside-subtree-ignored.tentative.html
deleted file mode 100644
index dde36224..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-marker-outside-subtree-ignored.tentative.html
+++ /dev/null
@@ -1,82 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>drawElementImage does not use SVG markers outside the subtree</title>
-  <link rel="help" href="https://github.com/WICG/html-in-canvas">
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src='/html/canvas/resources/canvas-tests.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-<body>
-  <svg width="0" height="0">
-    <defs>
-      <marker id="markerOut" markerUnits="userSpaceOnUse" viewBox="0 0 100 100" markerWidth="20" markerHeight="20" refX="50" refY="50">
-        <image href="/images/red-100x100.png" x="0" y="0" width="100" height="100" preserveAspectRatio="none"/>
-      </marker>
-    </defs>
-  </svg>
-
-  <canvas id="canvas" width="100" height="100" content=drawable>
-    <svg id=child width="100" height="100">
-      <marker id="markerIn" markerUnits="userSpaceOnUse" viewBox="0 0 100 100" markerWidth="20" markerHeight="20" refX="50" refY="50">
-        <image href="/images/green-100x100.png" x="0" y="0" width="100" height="100" preserveAspectRatio="none"/>
-      </marker>
-      <path d="M 20 20 L 50 20 L 80 20"
-        stroke="black"
-        marker-start="url(#markerOut)"
-        marker-mid="url(#markerOut)"
-        marker-end="url(#markerOut)" />
-      <path d="M 20 40 L 50 40 L 80 40"
-        stroke="black"
-        marker-start="url(#markerIn)"
-        marker-mid="url(#markerIn)"
-        marker-end="url(#markerIn)" />
-    </svg>
-  </canvas>
-
-  <script>
-    window.onload = () => {
-      promise_test(async function(t) {
-        const preloadImage = (url) => new Promise((resolve, reject) => {
-          const img = new Image();
-          img.onload = () => resolve(img);
-          img.onerror = () => reject(new Error(`Failed to load image: ${url}`));
-          img.src = url;
-        });
-
-        const imageEl1 = document.querySelector('#markerOut image');
-        const imageEl2 = document.querySelector('#markerIn image');
-        await Promise.all([
-          preloadImage(imageEl1.getAttribute('href')),
-          preloadImage(imageEl2.getAttribute('href')),
-        ]);
-
-        await waitForCanvasPaint(canvas);
-        var ctx = canvas.getContext('2d');
-        ctx.fillStyle = 'white';
-        ctx.fillRect(0, 0, 100, 100);
-        ctx.drawElementImage(child, 0, 0);
-
-        // The canvas should ignore the marker and draw the line black.
-        // Fetch all pixel data once to avoid multiple slow readbacks.
-        const imgData = ctx.getImageData(0, 0, canvas.width, canvas.height);
-
-        let pixel = _getPixelFromImageData(imgData, 15, 25);
-        assert_array_equals(pixel, [255, 255, 255, 255], "External start marker should not draw");
-        pixel = _getPixelFromImageData(imgData, 45, 25);
-        assert_array_equals(pixel, [255, 255, 255, 255], "External mid marker should not draw");
-        pixel = _getPixelFromImageData(imgData, 85, 25);
-        assert_array_equals(pixel, [255, 255, 255, 255], "External end marker should not draw");
-
-        pixel = _getPixelFromImageData(imgData, 15, 45);
-        assert_array_equals(pixel, [0, 255, 0, 255], "Internal start marker should draw");
-        pixel = _getPixelFromImageData(imgData, 45, 45);
-        assert_array_equals(pixel, [0, 255, 0, 255], "Internal mid marker should draw");
-        pixel = _getPixelFromImageData(imgData, 85, 45);
-        assert_array_equals(pixel, [0, 255, 0, 255], "Internal end marker should draw");
-      });
-    }
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-filter.tentative.https.sub.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-filter.tentative.https.sub.html
deleted file mode 100644
index 768caff..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-filter.tentative.https.sub.html
+++ /dev/null
@@ -1,74 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>drawElementImage does not use cross-origin feImages on filtered SVG text inside masks</title>
-  <link rel="help" href="https://github.com/WICG/html-in-canvas">
-  <script src='/resources/testharness.js'></script>
-  <script src='/resources/testharnessreport.js'></script>
-  <script src='/html/canvas/resources/canvas-tests.js'></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-
-<body>
-  <svg width="0" height="0">
-    <defs>
-      <filter id="filter-same" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-        <feImage href="https://{{location[host]}}/images/green-100x100.png"/>
-        <feComponentTransfer>
-          <feFuncR type="linear" slope="0" intercept="1"/>
-          <feFuncG type="linear" slope="0" intercept="1"/>
-          <feFuncB type="linear" slope="0" intercept="1"/>
-        </feComponentTransfer>
-      </filter>
-      <filter id="filter-cross" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-        <feImage href="https://{{hosts[alt][www]}}:{{ports[https][0]}}/images/red-100x100.png"/>
-        <feComponentTransfer>
-          <feFuncR type="linear" slope="0" intercept="1"/>
-          <feFuncG type="linear" slope="0" intercept="1"/>
-          <feFuncB type="linear" slope="0" intercept="1"/>
-        </feComponentTransfer>
-      </filter>
-      <mask id="mask-cross" maskUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-        <text x="0" y="50" filter="url(#filter-cross)">x</text>
-      </mask>
-    </defs>
-  </svg>
-
-  <canvas id="canvas" width="100" height="200" content=drawable>
-    <svg id="child" width="100" height="200">
-      <defs>
-        <mask id="mask-same" maskUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
-          <text x="0" y="50" filter="url(#filter-same)">x</text>
-        </mask>
-      </defs>
-      <svg x="0" y="0" width="100" height="100">
-        <rect width="100" height="100" fill="rgb(30, 130, 230)" mask="url(#mask-same)"/>
-      </svg>
-      <svg x="0" y="100" width="100" height="100">
-        <rect width="100" height="100" fill="rgb(40, 140, 240)" mask="url(#mask-cross)"/>
-      </svg>
-    </svg>
-  </canvas>
-
-  <script>
-    window.onload = () => {
-      promise_test(async function(t) {
-        await waitForCanvasPaint(canvas);
-        var ctx = canvas.getContext('2d');
-        ctx.fillStyle = 'blue';
-        ctx.fillRect(0, 0, 100, 200);
-        ctx.drawElementImage(document.getElementById('child'), 0, 0);
-
-        // Fetch all pixel data once to avoid multiple slow readbacks.
-        const imgData = ctx.getImageData(0, 0, canvas.width, canvas.height);
-
-        let pixel = _getPixelFromImageData(imgData, 50, 50);
-        assert_array_equals(pixel, [30, 130, 230, 255], "Same origin filter image in internal mask should be drawn");
-
-        pixel = _getPixelFromImageData(imgData, 50, 150);
-        assert_array_equals(pixel, [0, 0, 255, 255], "Cross origin filter image in external mask should not be drawn");
-      });
-    }
-  </script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-nested-filter.tentative.https.sub.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-nested-filter.tentative.https.sub.html
deleted file mode 100644
index 51cee79..0000000
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/svg-mask-nested-filter.tentative.https.sub.html
+++ /dev/null
@@ -1,100 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>drawElementImage does not use cross-origin feImages on nested filtered SVG content inside masks</title>
-  <link rel="help" href="https://github.com/WICG/html-in-canvas">
-  <script src="/resources/testharness.js"></script>
-  <script src="/resources/testharnessreport.js"></script>
-  <script src="/html/canvas/resources/canvas-tests.js"></script>
-  <script src="/html/canvas/resources/wait-for-canvas-paint.js"></script>
-</head>
-
-<body>
-  <svg width="0" height="0">
-    <defs>
... (truncated)