Possible bug in Canvas_1M_Dynamic?

[ndanner-wesleyancs]

@tim-stephenson

Please take a look at my research log entry for 03 March 2023. My analysis there indicates that there might be a bug in Canvas_1M_Dynamic.

[ndanner-wesleyancs]

I looked myself, and see the bug. The log entry I refer you to doesn't quite give enough context to see it. But the problem is that your implementation declares a script to be a non-classifier if it sets the height or width to < 16. The problem is that a script might set the height or width many times. The script I analyze in that log entry sets the height and width to 1 each, then later (just before writing text to the canvas in a couple of different colors and fonts) sets them to larger values.

So you need to rethink your logic for the classifier. You could just change the test to "is a classifier if it sets the height and width to >= 16" and the other tests.

But even that isn't so great, because what you are really doing is treating the Web API accesses as a set, and determining whether certain symbols are or are not in the set. But a more precise implementation considers the order of the accesses to the API. You really want to see that the canvas is set to a certain minimum size, then text being written with a least two different colors or ten different characters, then toDataURL or getImageData being called. Of course, that's a harder classifier to write.

[ndanner-wesleyancs]

Another issue with this analyzer: I think you are misinterpreting the condition "at least 10 distinct characters." Your implementation checks whether the set of characters over all calls to fillText has size at least 10. But I interpret that condition as fillText is called with an argument that has at least 10 distinct characters.