1947672 - Enabling Trusted Types causes issues with Picture-in-Picture on www.youtube.com

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[celenity]

Attachment: pip.jpeg

Steps to reproduce:

1. Set dom.security.trusted_types.enabled to true (via your about:config or otherwise...)

2. Navigate to https://www.youtube.com, find and play a video, it doesn't matter what.

3. Activate Picture-in-Picture via the icon on the top right of the URL bar.

Actual results:

The video pops out with PiP, but also still continues playing on the https://www.youtube.com tab.

Expected results:

Video playback should stop on the https://www.youtube.com tab when PiP is active, just like it does when Trusted Types is disabled.

Comment 1

[Tom Schuster]

This is a great report. Thank you!

The problem must be the following:

TypeError: DOMParser.parseFromString: Sink type mismatch violation blocked by CSP
  generateContent chrome://global/content/elements/videocontrols.js:3304
  onsetup chrome://global/content/elements/videocontrols.js:3163

Our PiP code seems to be trying to parse a string using a content based DOMParser that is blocked by the Trusted Types policy set up by YouTube. We probably could/should either bypass the policy somehow (Using [NeedsCallerType] on parseFromString ?) or stop parsing in that context.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1931282

:fredw, since you are the author of the regressor, bug 1931282, could you take a look?

For more information, please visit BugBot documentation.

Comment 3

[Frederik Braun [:freddy]]

Bug is in PIP not TT

Comment 4

[Frédéric Wang (:fredw)]

Is the JS global of the PiP code not a Window? If so maybe, the patch from bug 1942517 helps? Otherwise, the PiP code will probably need to wrap the parameters into a trusted type to bypass the default policy check...

Comment 5

[Tom Schuster]

Attachment: Bug 1947672 - Make PiP bypass trusted types when using the DOMParser. r?smaug!,mconley!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9443fe4932fd
Make PiP bypass trusted types when using the DOMParser. r=smaug,pip-reviewers,mconley

Comment 7

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/9443fe4932fd