1724924 - Disallow displaying PDFs in sandboxed iframes

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Domenic Denicola]

Spec change: https://github.com/whatwg/html/pull/6946

Tests: https://github.com/web-platform-tests/wpt/pull/29951

Comment 1

[David Parks [:handyman]]

Changing components since this is a PDF Viewer bug.

Comment 2

[Daniel Holbert [:dholbert]]

This is still an issue per
http://wpt.live/html/semantics/embedded-content/the-iframe-element/sandbox_004.htm

Our behavior here is sort of in the right direction - we don't actually display the PDF, but we do display the PDF-viewer-UI (without any PDF document inside of it). And we fail to display the fallback content, if fallback content is provided.

Comment 3

[Daniel Holbert [:dholbert]]

wpt.fyi: https://wpt.fyi/results/html/semantics/embedded-content/the-iframe-element/sandbox_004.htm

(Chrome/Safari pass, Firefox fails.)

Comment 4

[Calixte Denizet (:calixte)]

The pdf viewer shouldn't be involved in such case so I don't think it's a pdf.js bug but more likely a bug in DOM (Core & HTML ??).
If we don't have any fallback, do we want to display a download button or something like that (like for bug 1655525) ?
:dholbert, wdyt ?

Comment 5

[Daniel Holbert [:dholbert]]

(In reply to Calixte Denizet (:calixte) from comment #4)

The pdf viewer shouldn't be involved in such case so I don't think it's a pdf.js bug but more likely a bug in DOM (Core & HTML ??).

Agreed (DOM: Core&HTML or perhaps DOM: Security). --> Reclassifying.

If we don't have any fallback, do we want to display a download button or something like that (like for bug 1655525) ?

I'm not super familiar with sandboxed iframes, so I don't have a good intuition of whether that'd be worth doing (or worth not-doing).

FWIW Chrome doesn't seem to provide any fallback in this case, based on some local testing I just did (editing a local copy of the iframe in the WPT that I linked in comment 3, and viewing it through the WPT harness).

Comment 6

[Henri Sivonen (:hsivonen) (on vacation)]

farre, I vaguely recall that you worked on the object element at some point. Does this look to you like this would be easy to do?

Comment 7

[Andreas Farre [:farre]]

I'll take a look at it.

Comment 8

[Andreas Farre [:farre]]

Attachment: Bug 1724924 - Disallow displaying PDFs in sandboxed iframes. r=#dom-core!

Comment 9

[Andreas Farre [:farre]]

Given that my solution is correct, this turned out to be relatively simple. Unfortunately I haven't been able to confirm with spec how this is supposed to be achieved, since the spec change detailed in this bug has long since been re-written to something else.

Comment 10

[Andreas Farre [:farre]]

Try push: https://treeherder.mozilla.org/jobs?repo=try&revision=e2087086cb681f366b8df065010b488805c5a4aa

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7eaef5ce1448
Disallow displaying PDFs in sandboxed iframes. r=dom-core,sefeng

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/49142 for changes under testing/web-platform/tests

Comment 13

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/7eaef5ce1448

Comment 14

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot