Closed Bug 1151638 Opened 5 years ago Closed 5 years ago

NoScript blocks "mediasource:" content which breaks MSE HTML5 video (including YouTube)

Categories

(Core :: Audio/Video, defect, P1)

x86
macOS
defect

Tracking

()

RESOLVED FIXED
Tracking Status
firefox37 --- affected
firefox38 - affected
firefox39 - affected
firefox40 - affected

People

(Reporter: cpeterson, Unassigned)

References

(Blocks 2 open bugs)

Details

People report that YouTube HTML5 video using MSE will work if you change your NoScript settings to allow 'mediasource:'.
I'm aware of this issue, already evaluated the security implications and decided to handle mediasource: exactly the same as blob:, i.e. whitelisting it by default.
It's gonna be the default in next release, due in a couple of days.
Thanks, Giorgio!

This problem actually breaks any website playing HTML5 video with MSE, not just YouTube.
Blocks: EME
Priority: -- → P1
Summary: NoScript blocks "mediasource:" which breaks YouTube HTML5 video using MSE → NoScript blocks "mediasource:" content which breaks MSE HTML5 video (including YouTube)
(In reply to Chris Peterson [:cpeterson] from comment #2)
> Thanks, Giorgio!
> 
> This problem actually breaks any website playing HTML5 video with MSE, not
> just YouTube.

Does the "media.mediasource.youtubeonly" preference being set to true mean that it's still a YouTube-only problem on Firefox 37 at least?
Could you please check whether 2.6.9.21rc1 does what's intended to do (i.e. fixes this issue)?
https://noscript.net/getit#devel

Thanks!
Flags: needinfo?(cpeterson)
(In reply to Giorgio Maone from comment #3)
> Does the "media.mediasource.youtubeonly" preference being set to true mean
> that it's still a YouTube-only problem on Firefox 37 at least?

This is not a YouTube-only problem. The "media.mediasource.youtubeonly" has been renamed to "media.mediasource.whitelist" and the current list of MSE-allowed domains is here:

https://mxr.mozilla.org/mozilla-central/source/dom/media/mediasource/MediaSource.cpp#376

(In reply to Giorgio Maone from comment #4)
> Could you please check whether 2.6.9.21rc1 does what's intended to do (i.e.
> fixes this issue)?
> https://noscript.net/getit#devel

With dev build 2.6.9.21rc1, YouTube HTML5 video plays correctly! I can reproduce the problem with NoScript stable version 2.6.9.20, but I have to manually set my Flash plugin to "Never Activate" and opt into YouTube HTML5 (https://www.youtube.com/html5) because YouTube is temporarily defaulting all Firefox versions and platforms to Flash video.
Flags: needinfo?(cpeterson)
Anthony will test whether NoScript blocks EME.
Flags: needinfo?(ajones)
This site is blocked http://people.mozilla.org/~cpearce/mse-clearkey/ but I'm guessing that is what is intended.
Flags: needinfo?(ajones)
Tracking as this impacts MSE and is one of the bugs that caused us to revert to Flash for 37.
NoScript version 2.6.9.21 with the mediasource fix is live on AMO so we no longer need to track this issue.

https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/?page=1#version-2.6.9.21
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.