Last Comment Bug 1151638 - NoScript blocks "mediasource:" content which breaks MSE HTML5 video (including YouTube)
: NoScript blocks "mediasource:" content which breaks MSE HTML5 video (includin...
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Audio/Video (show other bugs)
: unspecified
: x86 Mac OS X
P1 normal (vote)
: ---
Assigned To: Nobody; OK to take it and work on it
:
: Maire Reavy [:mreavy] Please needinfo me
Mentors:
Depends on:
Blocks: MSE EME 1032660 1175296
  Show dependency treegraph
 
Reported: 2015-04-06 14:36 PDT by Chris Peterson [:cpeterson]
Modified: 2015-06-16 14:43 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
affected
-
affected
-
affected
-
affected


Attachments

Description User image Chris Peterson [:cpeterson] 2015-04-06 14:36:20 PDT
People report that YouTube HTML5 video using MSE will work if you change your NoScript settings to allow 'mediasource:'.
Comment 1 User image Giorgio Maone [:mao] 2015-04-06 14:42:16 PDT
I'm aware of this issue, already evaluated the security implications and decided to handle mediasource: exactly the same as blob:, i.e. whitelisting it by default.
It's gonna be the default in next release, due in a couple of days.
Comment 2 User image Chris Peterson [:cpeterson] 2015-04-06 15:00:01 PDT
Thanks, Giorgio!

This problem actually breaks any website playing HTML5 video with MSE, not just YouTube.
Comment 3 User image Giorgio Maone [:mao] 2015-04-06 15:24:33 PDT
(In reply to Chris Peterson [:cpeterson] from comment #2)
> Thanks, Giorgio!
> 
> This problem actually breaks any website playing HTML5 video with MSE, not
> just YouTube.

Does the "media.mediasource.youtubeonly" preference being set to true mean that it's still a YouTube-only problem on Firefox 37 at least?
Comment 4 User image Giorgio Maone [:mao] 2015-04-06 15:31:53 PDT
Could you please check whether 2.6.9.21rc1 does what's intended to do (i.e. fixes this issue)?
https://noscript.net/getit#devel

Thanks!
Comment 5 User image Chris Peterson [:cpeterson] 2015-04-06 18:30:39 PDT
(In reply to Giorgio Maone from comment #3)
> Does the "media.mediasource.youtubeonly" preference being set to true mean
> that it's still a YouTube-only problem on Firefox 37 at least?

This is not a YouTube-only problem. The "media.mediasource.youtubeonly" has been renamed to "media.mediasource.whitelist" and the current list of MSE-allowed domains is here:

https://mxr.mozilla.org/mozilla-central/source/dom/media/mediasource/MediaSource.cpp#376

(In reply to Giorgio Maone from comment #4)
> Could you please check whether 2.6.9.21rc1 does what's intended to do (i.e.
> fixes this issue)?
> https://noscript.net/getit#devel

With dev build 2.6.9.21rc1, YouTube HTML5 video plays correctly! I can reproduce the problem with NoScript stable version 2.6.9.20, but I have to manually set my Flash plugin to "Never Activate" and opt into YouTube HTML5 (https://www.youtube.com/html5) because YouTube is temporarily defaulting all Firefox versions and platforms to Flash video.
Comment 6 User image Chris Peterson [:cpeterson] 2015-04-09 13:19:38 PDT
Anthony will test whether NoScript blocks EME.
Comment 7 User image Anthony Jones (:kentuckyfriedtakahe, :k17e) 2015-04-12 19:52:27 PDT
This site is blocked http://people.mozilla.org/~cpearce/mse-clearkey/ but I'm guessing that is what is intended.
Comment 8 User image Lawrence Mandel [:lmandel] (use needinfo) 2015-04-13 09:36:22 PDT
Tracking as this impacts MSE and is one of the bugs that caused us to revert to Flash for 37.
Comment 9 User image Chris Peterson [:cpeterson] 2015-04-13 14:14:24 PDT
NoScript version 2.6.9.21 with the mediasource fix is live on AMO so we no longer need to track this issue.

https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/?page=1#version-2.6.9.21
Comment 10 User image Sylvestre Ledru [:sylvestre] 2015-04-15 01:42:56 PDT
cf comment #9

Note You need to log in before you can comment on or make changes to this bug.