889320 - Firefox does not show PDF when Content Security Policy is enabled

Status: VERIFIED FIXED

(Firefox :: PDF Viewer, defect, P2)

Description

[bogomip]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0 (Beta/Release)
Build ID: 20130625125232

Steps to reproduce:

1. Upload a PDF to a site that secures downloads of previously uploaded files by a Content Security Policy.

2. Download the file (with content-dispostion inline).


Actual results:

Since Firefox uses pdf.js to display the PDF file, the PDFs are not rendered anymore.

Here is an example for the response headers:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private, max-age=0
Content-Disposition: inline; filename="ECMA-262-5thEdition.pdf"
Content-Security-Policy: default-src 'none'
X-Content-Security-Policy: sandbox; default-src 'none'
Content-Type: application/pdf
Transfer-Encoding: chunked
Date: Tue, 02 Jul 2013 11:31:50 GMT

2000
%PDF-1.4
%....



Expected results:

Firefox should display the PDF as expected but should block all scripts that may be part of the downloaded source.

Unfortunately this bug tends to move customers to disable CSP completely in order to remedy the defective behaviour. So please consider to disable pdf.js by default.

Comment 1

[Paul Silaghi, QA [:pauly]]

(In reply to bogomip from comment #0)
> 1. Upload a PDF to a site that secures downloads of previously uploaded
> files by a Content Security Policy.
Concrete examples of site and pdf please

Comment 2

[bogomip]

Attachment: Test case in ZIP archive

The test case contains a HTTP server and a page for PDF download with and without content security policy.

Comment 3

[Paul Silaghi, QA [:pauly]]

Doesn't work on Chrome either.

Comment 4

[bogomip]

Chrome with pdf.js seems to work.

See https://github.com/mozilla/pdf.js/issues/3511.

Comment 5

[Paul Silaghi, QA [:pauly]]

Verified fixed 28.0a1 (2013-10-30) Win 7