New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 796994 link

Starred by 2 users
Status: WontFix
Owner:
█ mkwst@chromium.org
Buried. Ping if important.
Closed: Jan 2018
Cc:
█ sc00335...@techmahindra.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Baen (SF/Fantasy) publisher HTML E-books does not display properly from local file system

Project Member Reported by yn...@vivaldi.com, Dec 21 2017 
UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.97 Safari/537.36 Vivaldi/1.94.1008.36

Example URL:

Steps to reproduce the problem:
1. Download an HTML zip e-book from the Baen Ebooks shop, for example pick one from its free library <http://www.baen.com/catalog/category/view/s/free-library/id/2012>. Examples uploaded are using the book "Boundary" by Flint&Spoor <http://www.baen.com/boundary.html> direct downloadlink <http://www.baen.com/download/index/owned/id/503>
2. Extract the zipped files into a directory
3. Open the main document of the book; in the case of "Boundary" that is "Boundary.htm" (name usually match the title). e.g using a URL like <file://localhost/C:/e-books/Boundary/Boundary.htm>

What is the expected behavior?
The displayed book should have

1) A title bar on top, a single line with the book title, authors, and chapter info.

2) A sidebar on the left with a chapter index, a font selection box, plus several other links

3) A chapter of the book displayed in the main frame of the book.

What went wrong?
1) The title bar is empty

2) The sidebar is almost empty, only a link to the Baen home page is displayed

3) Technically, it can be argued that the main frame is displayed "correctly", in that the entire content of the page is displayed correctly; however, instead of the first page of the book (in the "Boundary" case the "Part I" page should be displayed)

Does it occur on multiple sites: Yes

Is it a problem with a plugin? No 

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 63.0.3239.108  Channel: stable
OS Version: 10.0
Flash Version: 

Attached are screenshots from Chrome 63.108, Edge (current version on my Win 10 machine), Firefox 57.02, and Opera 12.17. The non-Chromium browsers display the books correctly. (My main browser, the Chromium based Vivaldi, displays the books like Chrome, of course)

Some inspector logs I have looked at indicates that the display of the page is halted due to JS/DOM cross-frame permission problems

At present, Chromium based browsers are the only ones not able to correctly display these books, and Baen support have said "Use another browser"; which is actually what I am doing, by using Opera 12 to read these books.
HTML_Ebook_Boundary_Chrome_63.108.png
81.5 KB View Download
HTML_Ebook_Boundary_Edge.png
124 KB View Download
HTML_Ebook_Boundary_Mozilla_57.02.png
89.8 KB View Download
HTML_Ebook_Boundary_Opera_12.png
92.4 KB View Download

Comment 1 by schenney@chromium.org, Dec 25 2017

Components: -Blink Blink>SecurityFeature>CORS
I suspect they are running into our strong security features, and the site is in error. But over to someone who might know for sure.

Comment 2 by sc00335...@techmahindra.com, Dec 27 2017

Cc: sc00335...@techmahindra.com
Labels: Triaged-ET M-65 Needs-Triage-M63 OS-Linux OS-Mac
Status: Untriaged (was: Unconfirmed)
Able to reproduce this issue on reported version 63.0.3239.108 and on latest canary 65.0.3305.0 using Windows 10, Ubuntu 14.04, Mac 10.13.1 with link given in comment#0

This issue is seen from M50[50.0.2661.0]. Hence considering this issue as Non-Regression and marking as Untriaged.

Thanks!

Comment 3 by mkwst@chromium.org, Dec 28 2017

Owner: mkwst@chromium.org
Status: Assigned (was: Untriaged)
I won't be able to look at this until the new year, but we're generally stricter about `file:` URL capabilities than other browsers (though I suspect that these examples are broken in Safari as well...). I'll poke at it in January to see what exactly's broken here, and whether it's possible to fix without weakening the boundaries.

(See also https://github.com/whatwg/html/issues/3099)

Comment 4 by mkwst@chromium.org, Jan 22 2018

Status: WontFix (was: Assigned)
I had a chance to take a look this morning, and these books are certainly doing things we don't allow today by loading multiple `file://` pages into various parts of a frameset, and allowing them to script each other. We block this behavior today, as it could otherwise allow bad actors to scan a user's hard drive in the worst case (and `/Downloads` directory in the Firefox case). I don't think we'll be able to put together a mechanism that preserves that behavior while also addressing the risks.

Since we've already eaten the compatibility cost here, I'd prefer to preserve our behavior.
►

Sign in to add a comment