Closed Bug 1256148 Opened 6 years ago Closed 6 years ago

Can not upload file on Yandex.Disk in Firefox 45 with Web Workers enabled

Categories

(Web Compatibility :: Desktop, defect)

defect
Not set
normal

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: unghost, Unassigned)

References

()

Details

(Keywords: dev-doc-complete, regression, site-compat)

STR:
1) Login in Yandex.Disk (https://disk.yandex.com/)
2) Click on "Upload" button and select file to upload

Expected results:
File is uploaded 

Actual results:
File is not uploaded.

Workaround: Disable Web Workers: about:config -> set dom.workers.enabled to false. With Web Workers disabled file upload works fine.
Do you see any errors in the console?
(In reply to Kohei Yoshino [:kohei] from comment #1)
> Do you see any errors in the console?

POST 
https://disk.yandex.com/monitoring.txt [HTTP/1.1 204 No Content 490ms]
GET 
https://disk.yandex.com/monitoring.txt [HTTP/1.1 204 No Content 19ms]
Content Security Policy: The page's settings blocked the loading of a resource at https://yastatic.net/disk/www/4.2.0/_forge.js ("default-src blob: https://disk.yandex.com"). (unknown)
NetworkError: Failed to load worker script at https://yastatic.net/disk/www/4.2.0/_forge.js (nsresult = 0x805e0006) /:1:0
Strict-Transport-Security: The site specified a header that could not be parsed successfully.[Learn More] monitoring.txt
Strict-Transport-Security: The site specified a header that could not be parsed successfully.[Learn More] monitoring.txt
Yeah, I just created a new Yandex account, uploaded a file and saw the same CSP error. Will look for a relevant bug.
Found it.
Blocks: 1223647
Keywords: dev-doc-needed
CSP of https://disk.yandex.com/:
> default-src blob: 'self';
> script-src yastatic.net yandex.st ...

blob worker of https://disk.yandex.com/:
> importScripts("https://yastatic.net/disk/www/4.2.0/_forge.js"); ...

The patch for Bug 1223647 says "blob: workers *do* inherit CSP" so it should work. Why it doesn't work? My guess is...

The default-src is used instead of script-src because the blob has no content type.

https://yastatic.net/disk/client/3.5.5/_index.en.js
> new Worker(URL.createObjectURL(new Blob(['importScripts(' + r + ');',
> '(' + n.toString() + ')(' + a + ')'])))

The solution might be:
> new Worker(URL.createObjectURL(new Blob(['importScripts(' + r + ');',
> '(' + n.toString() + ')(' + a + ')'], {type:'text/javascript'})))

Am I correct?
Flags: needinfo?(jonas)
I cannot reproduce the issue any more. New uploads completed successfully.
Flags: needinfo?(unghost)
Yes, it must be fixed now.
Awesome, thank you!
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: needinfo?(unghost)
Flags: needinfo?(jonas)
Resolution: --- → FIXED
Product: Tech Evangelism → Web Compatibility
You need to log in before you can comment on or make changes to this bug.