Content Security Policy prevent PDF opening in new window
Reported by
buck...@gmail.com,
Mar 15 2017
|
|||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36 Example URL: Steps to reproduce the problem: 1. Download the attached example 2. unzip 3. follow instructions in readme.txt to get server running 4 click on HTML is content security policy 5 click on PDF that opens in new page. What is the expected behavior? The PDF should render. What went wrong? Just a blank page is displayed. Does it occur on multiple sites: N/A Is it a problem with a plugin? No Did this work before? N/A Does this work in other browsers? Yes Chrome version: 57.0.2987.98 Channel: stable OS Version: OS X 10.12.3 Flash Version: It appear that when there is a HTML restricted by a Content Security Policy and that page contains a link to a PDF document that opens in a new window will fail to open, if the link to a PDF opens in the same window then it all works correctly: The CSP policy is: "sandbox allow-forms allow-scripts allow-top-navigation allow-popups allow-pointer-lock"
,
Mar 15 2017
,
Mar 15 2017
,
Mar 15 2017
,
Mar 17 2017
This looks like out of scope for TE(Due to connect to Local host), hence adding the respective label for it to triage further.
,
Mar 17 2017
Documents placed into a sandbox can't load plugins. The PDF viewer is a plugin, so it's blocked in that context. That bit makes sense. It's not clear to me, though, why the PDF loads in a sandboxed context. alexmos@, is it possible that we're not correctly resetting the sandbox bits on a frame when navigating the top level?
,
Mar 17 2017
Ah, I understand. The PDF works correctly when you navigate the top level, but does not work when you open a new window. This is working as intended, as sandbox properties propagate out to newly opened windows. If you add `allow-popups-to-escape-sandbox` to the sandbox policy, then newly opened windows will not inherit the sandbox flags, and your PDF will load as you expect it to.
,
Mar 17 2017
If this is considered the intended behaviour could a message be put in the console when sandboxing blocks content as this wasn't easy to track down. Side note: That behaviour seems almost counter intuitive, that sandbox properties don't persist when you navigate in the current window, but do persist when you open a new window and have the document open there. Why don't I need a property of 'allow-navigation-to-escape-sandbox'?
,
Nov 10 2017
,
Feb 18 2018
|
|||||||||||||
►
Sign in to add a comment |
|||||||||||||
Comment 1 by buck...@gmail.com
, Mar 15 2017