1256148 - Can not upload file on Yandex.Disk in Firefox 45 with Web Workers enabled

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[Alexander L. Slovesnik]

STR:
1) Login in Yandex.Disk (https://disk.yandex.com/)
2) Click on "Upload" button and select file to upload

Expected results:
File is uploaded 

Actual results:
File is not uploaded.

Workaround: Disable Web Workers: about:config -> set dom.workers.enabled to false. With Web Workers disabled file upload works fine.

Comment 1

[Kohei Yoshino [:kohei]]

Do you see any errors in the console?

Comment 2

[Alexander L. Slovesnik]

(In reply to Kohei Yoshino [:kohei] from comment #1)
> Do you see any errors in the console?

POST 
https://disk.yandex.com/monitoring.txt [HTTP/1.1 204 No Content 490ms]
GET 
https://disk.yandex.com/monitoring.txt [HTTP/1.1 204 No Content 19ms]
Content Security Policy: The page's settings blocked the loading of a resource at https://yastatic.net/disk/www/4.2.0/_forge.js ("default-src blob: https://disk.yandex.com"). (unknown)
NetworkError: Failed to load worker script at https://yastatic.net/disk/www/4.2.0/_forge.js (nsresult = 0x805e0006) /:1:0
Strict-Transport-Security: The site specified a header that could not be parsed successfully.[Learn More] monitoring.txt
Strict-Transport-Security: The site specified a header that could not be parsed successfully.[Learn More] monitoring.txt

Comment 3

[Kohei Yoshino [:kohei]]

Yeah, I just created a new Yandex account, uploaded a file and saw the same CSP error. Will look for a relevant bug.

Comment 4

[Kohei Yoshino [:kohei]]

Found it.

Comment 5

[Kohei Yoshino [:kohei]]

CSP of https://disk.yandex.com/:
> default-src blob: 'self';
> script-src yastatic.net yandex.st ...

blob worker of https://disk.yandex.com/:
> importScripts("https://yastatic.net/disk/www/4.2.0/_forge.js"); ...

The patch for Bug 1223647 says "blob: workers *do* inherit CSP" so it should work. Why it doesn't work? My guess is...

The default-src is used instead of script-src because the blob has no content type.

https://yastatic.net/disk/client/3.5.5/_index.en.js
> new Worker(URL.createObjectURL(new Blob(['importScripts(' + r + ');',
> '(' + n.toString() + ')(' + a + ')'])))

The solution might be:
> new Worker(URL.createObjectURL(new Blob(['importScripts(' + r + ');',
> '(' + n.toString() + ')(' + a + ')'], {type:'text/javascript'})))

Am I correct?

Comment 6

[Kohei Yoshino [:kohei]]

Notified the Yandex team: https://twitter.com/FxSiteCompat/status/709322708786532352

Comment 7

[Kohei Yoshino [:kohei]]

I cannot reproduce the issue any more. New uploads completed successfully.

Comment 8

[Danil Ivanov]

Yes, it must be fixed now.

Comment 9

[Kohei Yoshino [:kohei]]

Awesome, thank you!