Bug 118859 – Sandbox attribute on an iframe blocks PDF documents from being rendered

• Component: Frames
• Status: NEW

[Vestigal Organ]

Created attachment 207012 [details]
A test case that shows the behavior.

For an iframe, the sandbox attribute appears to block PDF files from being rendered, even if all of the sandbox's attributes are specified.

I've attached a simple test case that demonstrates it. The test case requires a PDF file named "test.pdf" to be in the same folder as the HTML file.

[Vestigal Organ]

Looking around a bit more, it seems that there is some debate as to how this should work. https://bugs.webkit.org/show_bug.cgi?id=39219 talked a bit about an allow-plugins value for the sandbox attribute, but it doesn't seem like much happened with it.

http://www.whatwg.org/specs/web-apps/current-work/#sandboxed-plugins-browsing-context-flag talks about a flag that can be set to allow plugins, but I don't see any way to do that.

http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox first says that plugins should be "secured" when the sandbox attribute is added, but then in the next couple of paragraphs it moves to talking about the plugins being disabled, instead.

[Alexey Proskuryakov]

Created attachment 207126 [details]
test case

The previous test case did not actually have a sandbox attribute, so it didn't demonstrate the issue.

Plug-ins are a complicated issue indeed, but I think that Safari's built-in PDF support should work (and it doesn't).

[Vestigal Organ]

Ah, hehe, I can't believe that I messed up the original test case so badly XD

Your test case reproduces the issue on my machine, as well. Thanks for writing it.