New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 634168 link

Starred by 4 users

Issue metadata

Status: Verified
Owner:
Closed: Sep 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

chrome://cast page blank - extensionview not displayed

Project Member Reported by sheretov@chromium.org, Aug 3 2016

Issue description

Version: 54.0.2817.0
OS: OSX

Steps to reproduce:
(1) Go to chrome://cast
(2) Observe empty page and error in JS console:
VM326 extensions::guestViewContainer:212 Refused to load plugin data from '' because it violates the following Content Security Policy directive: "object-src *".
(3) Go to dev tools -> Elements, right click on the extensionview element and choose "Open link in new tab". Observe the "chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm/cast_setup/index.html#devices" page loading and displaying content.

Expected:
No error and extensionview contents displayed.
 
Cc: lazyboy@chromium.org
Owner: wjmaclean@chromium.org
Assigning to wjmaclean@ for triage after checking with lazyboy@.
Cc: wjmaclean@chromium.org
Owner: paulmeyer@chromium.org
paulmeyer@ has experience with this, re-assigning (Paul, re-assign it back if it turns out to be something different).
Labels: Needs-Feedback
I'm having trouble reproing this. I don't see the error listed in step 2, and I'm also not seeing the "open in new tab" option you describe in step 3.
Are you running the latest Canary? This issue started occurring quite recently.

For step 3 you have to right-click on the link shown in the 'src' attribute of the extensionview element.
I was running ToT, and there was no 'src' attribute on the <extensionview> in devTools.
fwiw I use the browser menu > more tools > developer tools to get the devtools for the entire page, not just the contents inside the extensionview.

I was able to repro on yesterday's canary, but unable to repro on a local build that was last updated a week ago (commit 4fd767727f8a4bd4e86d626fce4921972f8180f8).
Screen Shot 2016-08-04 at 9.00.42 AM.png
190 KB View Download
You need to go to the "Elements" tab in dev tools (see screenshot).  Anyway, that's just to show that the page hosted by the extension view is actually available.


Screen Shot 2016-08-04 at 9.07.14 AM.png
163 KB View Download
Labels: -Needs-Feedback
Status: WontFix (was: Assigned)
Confirmed as not reproducible in the latest Canary.
Status: Untriaged (was: WontFix)
Reopening the bug, since this is broken again in the latest canary (54.0.2830.0).
Status: Assigned (was: Untriaged)
I'm seeing this as well.
Ping. Any progress on this bug? This is a critical issue for Cast integration.
Labels: M-54 ReleaseBlock-Stable
This will have to be fixed before M54 goes out.
Cc: -wjmaclean@chromium.org paulmeyer@chromium.org
Owner: wjmaclean@chromium.org
After looking into this, it does not seem to be related to the bug I had encountered in the past ( Issue 539295 ). Reassigning back to wjmaclean@.

On a side note, when reproing this bug, I am also seeing a second error message not mentioned by the bug reporter, which says: "Uncaught (in promise) ReferenceError: reject is not defined
    at ExtensionViewImpl.onLoadRejected (extensions::extensionViewApiMethods:37)". I've reported it separately ( Issue 642849 ).
I meant to also mention that the second error is definitely unrelated to this bug, which is why I reported it as a separate bug.
Owner: paulmeyer@chromium.org
And... assigning back to myself for now.
Cc: -paulmeyer@chromium.org wjmaclean@chromium.org
This may actually be the same bug as Issue 514866.
Still occurs on 54.0.2840.8
Does anyone know of a build where this did work? I'm trying to find exactly when it broke.
I'm hanging on to my 6/24 checkout, which is still good.  However, since M53 does not have an issue, anything up to the branch point on 6/30 should still work.

Comment 22 by jleedev@gmail.com, Sep 7 2016

I think the breaking CL was commit 6104167b0bf16a3520a898dbe67227637d1c214e on June 29.
Project Member

Comment 23 by bugdroid1@chromium.org, Sep 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/67b0b5d046af90992bc94390a90647d7b4a00353

commit 67b0b5d046af90992bc94390a90647d7b4a00353
Author: paulmeyer <paulmeyer@chromium.org>
Date: Thu Sep 15 16:22:04 2016

Fix for chrome://cast getting blocked by content security policy.

The provided policy for the cast UI was "object-src *", which used to
include "chrome:" until a recent CL changed the use of “*” from a
blacklist (that did not include "chrome:") to a whitelist (that still does
not include "chrome:"). Because of this, the policy just needs to be updated
to specifically allow "chrome:" now.

BUG= 634168 

Review-Url: https://codereview.chromium.org/2347503002
Cr-Commit-Position: refs/heads/master@{#418883}

[modify] https://crrev.com/67b0b5d046af90992bc94390a90647d7b4a00353/chrome/browser/ui/webui/cast/cast_ui.cc

Status: Fixed (was: Assigned)
Labels: Merge-Request-54
Requesting merge into M54: change only affects chrome://cast page. Without this change chrome://cast is completely broken.

Comment 26 by dimu@chromium.org, Sep 20 2016

Labels: -Merge-Request-54 Merge-Approved-54 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M54 (branch: 2840)
Project Member

Comment 27 by bugdroid1@chromium.org, Sep 20 2016

Labels: -merge-approved-54 merge-merged-2840
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2962c9c21ab9dd1ebd407f7dcda01c817e4f75da

commit 2962c9c21ab9dd1ebd407f7dcda01c817e4f75da
Author: Paul Meyer <paulmeyer@chromium.org>
Date: Tue Sep 20 18:02:05 2016

Fix for chrome://cast getting blocked by content security policy.

The provided policy for the cast UI was "object-src *", which used to
include "chrome:" until a recent CL changed the use of “*” from a
blacklist (that did not include "chrome:") to a whitelist (that still does
not include "chrome:"). Because of this, the policy just needs to be updated
to specifically allow "chrome:" now.

BUG= 634168 

Review-Url: https://codereview.chromium.org/2347503002
Cr-Commit-Position: refs/heads/master@{#418883}
(cherry picked from commit 67b0b5d046af90992bc94390a90647d7b4a00353)

Review URL: https://codereview.chromium.org/2350403003 .

Cr-Commit-Position: refs/branch-heads/2840@{#445}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/2962c9c21ab9dd1ebd407f7dcda01c817e4f75da/chrome/browser/ui/webui/cast/cast_ui.cc

Labels: TE-Verified-54.0.2840.34 TE-Verified-M54
Verified the issue on Mac 10.11.6 using 54.0.2840.34 and its working fine now.
Please find the attached screen cast for the same.
634168_Sept_21.mp4
584 KB View Download
Status: Verified (was: Fixed)
I don't see this on 55.0.2868.3
Project Member

Comment 30 by bugdroid1@chromium.org, Oct 27 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2962c9c21ab9dd1ebd407f7dcda01c817e4f75da

commit 2962c9c21ab9dd1ebd407f7dcda01c817e4f75da
Author: Paul Meyer <paulmeyer@chromium.org>
Date: Tue Sep 20 18:02:05 2016

Fix for chrome://cast getting blocked by content security policy.

The provided policy for the cast UI was "object-src *", which used to
include "chrome:" until a recent CL changed the use of “*” from a
blacklist (that did not include "chrome:") to a whitelist (that still does
not include "chrome:"). Because of this, the policy just needs to be updated
to specifically allow "chrome:" now.

BUG= 634168 

Review-Url: https://codereview.chromium.org/2347503002
Cr-Commit-Position: refs/heads/master@{#418883}
(cherry picked from commit 67b0b5d046af90992bc94390a90647d7b4a00353)

Review URL: https://codereview.chromium.org/2350403003 .

Cr-Commit-Position: refs/branch-heads/2840@{#445}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/2962c9c21ab9dd1ebd407f7dcda01c817e4f75da/chrome/browser/ui/webui/cast/cast_ui.cc

Sign in to add a comment