MCP server SVG feComponentTransfer consent security — feFuncA type="discrete" tableValues="0" alpha-zeroing, feFuncA type="linear" slope="0", feFuncR/G/B slope="0" intercept="0" RGB collapse, and feFuncA type="gamma" amplitude="0"

Attack 1: feFuncA type="discrete" tableValues="0" — alpha-zero via step function (SA-CSS-FCT-001)

The discrete transfer function maps each input value to the nearest value in a table of output values, using a step function. With tableValues="0" (a single entry), the discrete function maps every input value in [0, 1] to the single output value 0. Applied to the alpha channel via feFuncA, every pixel in the consent element — regardless of its original alpha value — has its alpha set to 0. The entire consent element becomes fully transparent.

The attack is distinct from feColorMatrix alpha-row zeroing in that it uses a per-channel transfer function rather than a full 4×5 matrix multiplication. An auditor who checks only for feColorMatrix with an alpha-zero matrix row will miss this pattern.

<!-- SA-CSS-FCT-001: feFuncA type=discrete tableValues=0 — alpha-zeroing via step function
     discrete tableValues=0: single step value = 0
     For input alpha in [0,1]: output = tableValues[floor(input * n)] where n=1
       input [0,1) → floor(input*1)=0 → tableValues[0]=0
     All alpha values mapped to 0 regardless of input. Entire consent element transparent. -->
<filter id="fct-alpha-discrete">
  <feComponentTransfer>
    <feFuncA type="discrete" tableValues="0"/>
    <!-- feFuncR, feFuncG, feFuncB not specified → implicit identity (unchanged) -->
  </feComponentTransfer>
</filter>

<div id="consent" style="filter:url(#fct-alpha-discrete)">
  <p>Requesting: credential access, filesystem read, network egress.</p>
  <button id="allow">Allow</button>
</div>

// discrete table lookup: tableValues="0" means one step: all inputs → 0
// tableValues="0 0 0 0 0" also maps all inputs to 0 (five steps, all zero)
// tableValues="1" maps all inputs to 1 (identical — no change, but suspicious)
// tableValues="0 0" maps lower half to 0, upper half to 0 (same result)
// tableValues="0 0 0 0 0 0 0 0 0 0" (ten zeros) — same effect, harder to spot

// Detection: parse tableValues as a whitespace-separated list
// If all values are 0 (or sum is 0), flag CRITICAL for feFuncA, HIGH for feFuncR/G/B
function auditFeFuncA(funcEl) {
  const type = funcEl.getAttribute('type') || 'identity';
  if (type === 'discrete' || type === 'table') {
    const vals = (funcEl.getAttribute('tableValues') || '').trim()
                  .split(/\s+/).map(Number);
    const allZero = vals.every(v => v === 0);
    if (allZero) return { sev: 'CRITICAL', note: `feFuncA type="${type}" tableValues all-zero → alpha=0` };
  }
  if (type === 'linear') {
    const slope     = parseFloat(funcEl.getAttribute('slope')     || '1');
    const intercept = parseFloat(funcEl.getAttribute('intercept') || '0');
    if (slope === 0 && intercept === 0) {
      return { sev: 'CRITICAL', note: 'feFuncA type=linear slope=0 intercept=0 → alpha=0 for all inputs' };
    }
  }
  if (type === 'gamma') {
    const amplitude = parseFloat(funcEl.getAttribute('amplitude') || '1');
    const offset    = parseFloat(funcEl.getAttribute('offset')    || '0');
    if (amplitude === 0 && offset === 0) {
      return { sev: 'CRITICAL', note: 'feFuncA type=gamma amplitude=0 offset=0 → alpha=0 for all inputs' };
    }
  }
  return null;
}

Attack 2: feFuncA type="linear" slope="0" intercept="0" — alpha-zero via linear transfer (SA-CSS-FCT-002)

The linear transfer function applies the formula C_out = slope × C_in + intercept. With slope="0" and intercept="0", the output is 0 × C_in + 0 = 0 for all input values. Applied to the alpha channel, every pixel's alpha is set to 0 — the consent element is fully transparent, identical in effect to the discrete tableValues=0 variant but using a different SVG type attribute.

A security scanner that checks for feFuncA type="discrete" or feFuncA type="table" but not feFuncA type="linear" will miss this variant. The three types (discrete, table, linear) are semantically distinct but can all produce zero output for all inputs. An auditor must check all four non-identity transfer function types (linear, gamma, table, discrete) for alpha-zeroing conditions.

<!-- SA-CSS-FCT-002: feFuncA type=linear slope=0 intercept=0 — alpha-zero via linear formula
     C_out = slope * C_in + intercept = 0 * C_in + 0 = 0 for all C_in ∈ [0,1]
     Every pixel alpha → 0. Entire consent element fully transparent.
     Distinct type from discrete/table — bypasses type-specific checks. -->
<filter id="fct-alpha-linear">
  <feComponentTransfer>
    <feFuncA type="linear" slope="0" intercept="0"/>
  </feComponentTransfer>
</filter>

// Variants of linear feFuncA alpha attacks:
// slope=0  intercept=0: C_out = 0            → always transparent (CRITICAL)
// slope=0  intercept=0.1: C_out = 0.1        → near-transparent (HIGH if < 0.2)
// slope=0.1 intercept=0: C_out = 0.1*C_in   → scaled down; opaque text (C_in=1) → 0.1 alpha
// slope=-1 intercept=1: C_out = 1-C_in       → alpha inversion (transparent↔opaque)
//                                              transparent background (A=0) → A=1
//                                              opaque text (A=1) → A=0
//                                              Consent text transparent; background opaque (inverted)

// Alpha inversion (slope=-1, intercept=1) is a particularly subtle attack:
// The element appears as a negative — background areas have a color, text areas are transparent.
// On a dark background, this renders the consent panel as a dark rectangle with transparent text shapes.
// The text shapes are readable in outline (they're transparent holes) but not as legible text.

Attack 3: feFuncR/G/B type="linear" slope="0" intercept="0" — RGB channel collapse, invisible on dark backgrounds (SA-CSS-FCT-003)

The prior two attacks zero the alpha channel, making the entire consent element transparent. The RGB-collapse variant instead zeros the R, G, and B channels while leaving the alpha channel unchanged. Applied to consent text, the text glyph pixels become rgba(0, 0, 0, 1) — fully opaque pure black. On a light background (white or near-white), black text on white is actually high-contrast and readable. On a dark background (common in modern UIs: #1a1a1a, #0f0f0f, dark-mode consent panels), fully black text on a near-black background has a contrast ratio near 1:1 — invisible.

The attack is therefore background-dependent. An auditor testing on a light background might not notice the attack; the same consent panel in a dark-mode UI or a dark-themed MCP client renders the text as transparent black on a black background. The feFuncR/G/B slope=0 pattern leaves the element's color CSS property unchanged (getComputedStyle(el).color still reports the original text color), but the filter overrides the rendered RGB values to zero.

<!-- SA-CSS-FCT-003: feFuncR/G/B slope=0 intercept=0 — zeros all RGB channels
     Text pixels: rgb(17,25,39) → rgb(0,0,0) with alpha=1 (fully opaque black)
     On dark background #1a1a1a = rgb(26,26,26):
       WCAG contrast: (0.05 + 0.05) / (0.003 + 0.05) ≈ 1.04:1 — invisible
     On light background #fff:
       WCAG contrast: (1.0 + 0.05) / (0.0 + 0.05) = 21:1 — fully readable
     Attack is background-dependent; testing on light background passes -->
<filter id="fct-rgb-zero">
  <feComponentTransfer>
    <feFuncR type="linear" slope="0" intercept="0"/>
    <feFuncG type="linear" slope="0" intercept="0"/>
    <feFuncB type="linear" slope="0" intercept="0"/>
    <!-- feFuncA not specified → identity → alpha unchanged -->
  </feComponentTransfer>
</filter>

// getComputedStyle(el).color reports original CSS value (#111827 or whatever)
// Filter overrides rendered RGB to 0 — CSSOM blind spot for filter effects

// Dark-mode detection requirement:
// Auditor must test consent rendering on both light (#fff) and dark (#0f0f0f) backgrounds
// RGB-zeroing attack is invisible in dark mode, fully readable in light mode
// SkillAudit simulates both backgrounds when checking feComponentTransfer RGB effects

// Related: feFuncR slope=0 intercept=1 sets R=1 (forces all red), feFuncG slope=0 intercept=1
// sets G=1, feFuncB slope=0 intercept=1 sets B=1 → output rgb(255,255,255) = white
// With white background: contrast 1:1 — consent text invisible (same as feFlood white)
// With dark background: contrast ≈ 16:1 — consent text readable but changed to white

Attack 4: feFuncA type="gamma" amplitude="0" exponent="1" offset="0" — alpha-zero via gamma formula (SA-CSS-FCT-004)

The gamma transfer function applies the formula C_out = amplitude × C_in^exponent + offset. With amplitude="0" and offset="0" (any exponent), the output is 0 × C_in^exponent + 0 = 0 for all positive input values. (For C_in=0: 0^exponent = 0 for exponent>0, so output = 0 + 0 = 0 as well.) Applied to the alpha channel, the gamma formula zeros all alpha values — a third syntax for alpha-zeroing alongside the discrete and linear variants.

The gamma type is often associated with gamma correction or color grading, which may cause auditors to treat it as a benign visual styling adjustment rather than a security threat. A feFuncA type="gamma" amplitude="0.5" exponent="2.2" offset="0" is a genuine gamma correction that reduces alpha values (not to zero), while amplitude="0" exponent="1" offset="0" is an alpha-zeroing attack that happens to use the gamma syntax. Auditors must evaluate the amplitude and offset values, not just the function type.

<!-- SA-CSS-FCT-004: feFuncA type=gamma amplitude=0 — alpha-zero via gamma formula
     C_out = amplitude * C_in^exponent + offset
           = 0        * C_in^1        + 0
           = 0
     For all C_in ∈ [0,1]. Entire consent element fully transparent.
     Third syntax for alpha-zeroing: distinct from discrete and linear. -->
<filter id="fct-alpha-gamma">
  <feComponentTransfer>
    <feFuncA type="gamma" amplitude="0" exponent="1" offset="0"/>
  </feComponentTransfer>
</filter>

// Gamma formula variants:
// amplitude=0, offset=0 (any exponent): C_out = 0 → CRITICAL (alpha-zeroing)
// amplitude=1, exponent=2.2, offset=0:  C_out = C_in^2.2 → darkens (gamma correction)
//   For C_in=1 (opaque): C_out = 1 (still opaque) — not an attack
//   For C_in=0.5: C_out ≈ 0.22 (reduced opacity)
// amplitude=0.1, exponent=1, offset=0: C_out = 0.1*C_in → near-transparent for text (C_in=1 → 0.1)
//   HIGH: 10% opacity consent text — effectively invisible
// amplitude=0, exponent=1, offset=0.05: C_out = 0.05 → 5% opacity for all pixels
//   HIGH: near-transparent

// feFuncA type=table tableValues=0 (also alpha-zeroing):
// table lookup: for n values v_0 through v_{n-1}
//   k = input * n (then linearly interpolate between v_floor and v_ceil)
//   tableValues="0" → n=1, all outputs = v_0 = 0 → alpha=0
//   tableValues="0 0" → n=2, linear interp between 0 and 0 → still 0
//   tableValues="0 0 0 0 0" → n=5, all outputs = 0 → alpha=0
// Any tableValues string containing only zeros → alpha-zeroing attack

Summary table

Defences

• Check all four non-identity feFuncA types for zero-output conditions — linear (slope=0, intercept=0), gamma (amplitude=0, offset=0), discrete (all tableValues=0), and table (all tableValues=0) all produce fully transparent consent elements. Detection rules that check only one type miss the other three variants.
• Zero-filter policy on alpha-modifying primitives — prohibit any feComponentTransfer with a feFuncA child in consent element filter chains. Legitimate consent UI rendering does not require alpha manipulation via feComponentTransfer. Flag the presence of feFuncA as CRITICAL regardless of current parameter values (dynamic activation concern).
• Check RGB channel transfer functions for background-dependent invisibility — evaluate the predicted output RGB values against both light and dark backgrounds. A feFuncR/G/B that zeros RGB channels produces invisible text on dark backgrounds and readable text on light backgrounds. Audits must simulate both background colors.
• Resolve filter URLs and walk the full primitive chain — getComputedStyle(el).filter returns only the URL; the feFuncA parameters are inside the <feComponentTransfer> element which must be resolved via document.querySelector. Shadow DOM filter definitions require shadow root traversal.
• Flag the alpha inversion pattern (slope=−1, intercept=1) — this makes the consent text transparent while making background pixels opaque, creating a negative image. It is not detected by zero-output checks (the intercept=1 produces non-zero output for transparent pixels) but produces an unreadable consent rendering that fails WCAG contrast requirements.

SkillAudit findings for this attack surface

← Blog  |  Security Checklist