1151638 - NoScript blocks "mediasource:" content which breaks MSE HTML5 video (including YouTube)

Status: RESOLVED FIXED

(Core :: Audio/Video, defect, P1)

Description

[Chris Peterson [:cpeterson]]

People report that YouTube HTML5 video using MSE will work if you change your NoScript settings to allow 'mediasource:'.

Comment 1

[Giorgio Maone [:ma1]]

I'm aware of this issue, already evaluated the security implications and decided to handle mediasource: exactly the same as blob:, i.e. whitelisting it by default.
It's gonna be the default in next release, due in a couple of days.

Comment 2

[Chris Peterson [:cpeterson]]

Thanks, Giorgio!

This problem actually breaks any website playing HTML5 video with MSE, not just YouTube.

Comment 3

[Giorgio Maone [:ma1]]

(In reply to Chris Peterson [:cpeterson] from comment #2)
> Thanks, Giorgio!
> 
> This problem actually breaks any website playing HTML5 video with MSE, not
> just YouTube.

Does the "media.mediasource.youtubeonly" preference being set to true mean that it's still a YouTube-only problem on Firefox 37 at least?

Comment 4

[Giorgio Maone [:ma1]]

Could you please check whether 2.6.9.21rc1 does what's intended to do (i.e. fixes this issue)?
https://noscript.net/getit#devel

Thanks!

Comment 5

[Chris Peterson [:cpeterson]]

(In reply to Giorgio Maone from comment #3)
> Does the "media.mediasource.youtubeonly" preference being set to true mean
> that it's still a YouTube-only problem on Firefox 37 at least?

This is not a YouTube-only problem. The "media.mediasource.youtubeonly" has been renamed to "media.mediasource.whitelist" and the current list of MSE-allowed domains is here:

https://mxr.mozilla.org/mozilla-central/source/dom/media/mediasource/MediaSource.cpp#376

(In reply to Giorgio Maone from comment #4)
> Could you please check whether 2.6.9.21rc1 does what's intended to do (i.e.
> fixes this issue)?
> https://noscript.net/getit#devel

With dev build 2.6.9.21rc1, YouTube HTML5 video plays correctly! I can reproduce the problem with NoScript stable version 2.6.9.20, but I have to manually set my Flash plugin to "Never Activate" and opt into YouTube HTML5 (https://www.youtube.com/html5) because YouTube is temporarily defaulting all Firefox versions and platforms to Flash video.

Comment 6

[Chris Peterson [:cpeterson]]

Anthony will test whether NoScript blocks EME.

Comment 7

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

This site is blocked http://people.mozilla.org/~cpearce/mse-clearkey/ but I'm guessing that is what is intended.

Comment 8

[Lawrence Mandel [:lmandel] (use needinfo)]

Tracking as this impacts MSE and is one of the bugs that caused us to revert to Flash for 37.

Comment 9

[Chris Peterson [:cpeterson]]

NoScript version 2.6.9.21 with the mediasource fix is live on AMO so we no longer need to track this issue.

https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/?page=1#version-2.6.9.21

Comment 10

[Sylvestre Ledru [:Sylvestre]]

cf comment #9