MEDIUM: Missing error handling for canvas.toDataURL (SecurityError risk) #5

New issue

Closed

opened 2026-05-09 05:10:03 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 05:10:03 +00:00

Owner

Severity: MEDIUM

Location

tokengenerator.html, lines 381-388:

downloadBtn.addEventListener('click', () => {
    const link = document.createElement('a');
    const textPart = textInput.value.replace(/\s+/g, '_') || 'token';
    const iconPart = generatedIconImage ? 'ai_generated' : iconSelect.value;
    link.download = `token_${textPart}_${iconPart}.png`;
    link.href = canvas.toDataURL('image/png');
    link.click();
});

Description

canvas.toDataURL() throws a SecurityError if the canvas has been "tainted" by drawing cross-origin images (e.g., through the AI-generated icon loaded from a data URI or if third-party content is drawn). There is no try/catch around this call.

If the canvas is tainted, the download silently fails with a JavaScript error in console, and no feedback is given to the user.

Recommended Fix

Wrap toDataURL() in a try/catch block.
Display a user-friendly error message if the canvas cannot be exported.
Consider using canvas.toBlob() with proper error handling as an alternative.

Impact

Users may attempt to download tokens but get a silent failure with no feedback.

## Severity: MEDIUM ## Location `tokengenerator.html`, lines 381-388: ```javascript downloadBtn.addEventListener('click', () => { const link = document.createElement('a'); const textPart = textInput.value.replace(/\s+/g, '_') || 'token'; const iconPart = generatedIconImage ? 'ai_generated' : iconSelect.value; link.download = `token_${textPart}_${iconPart}.png`; link.href = canvas.toDataURL('image/png'); link.click(); }); ``` ## Description `canvas.toDataURL()` throws a `SecurityError` if the canvas has been "tainted" by drawing cross-origin images (e.g., through the AI-generated icon loaded from a data URI or if third-party content is drawn). There is no try/catch around this call. If the canvas is tainted, the download silently fails with a JavaScript error in console, and no feedback is given to the user. ### Recommended Fix - Wrap `toDataURL()` in a try/catch block. - Display a user-friendly error message if the canvas cannot be exported. - Consider using `canvas.toBlob()` with proper error handling as an alternative. ### Impact Users may attempt to download tokens but get a silent failure with no feedback.