Bug 243324 – webkit-pdfjs-viewer URI scheme should not be blocked by CSP

• Component: PDF
• Status: RESOLVED FIXED

[Michael Catanzaro]

Try loading: https://www.ameren.com/-/media/rates/files/missouri/uecsheet54rate1mres.ashx

It gets blocked by the page's CSP:

[Error] Refused to load webkit-pdfjs-viewer://pdfjs/web/viewer.html?file=#pagemode=none because it appears in neither the frame-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load webkit-pdfjs-viewer://pdfjs/extras/adwaita/style.css because it appears in neither the style-src directive nor the default-src directive of the Content Security Policy.
[Error] Refused to load webkit-pdfjs-viewer://pdfjs/extras/content-script.js because it appears in neither the script-src directive nor the default-src directive of the Content Security Policy.

We should exempt our own internal webkit-pdfjs-viewer URI scheme from CSP checks. It's an implementation detail of the website. We actually added new public WPE/GTK port API to allow Epiphany to do this, webkit_web_view_set_cors_allowlist(), (which is suddenly longer needed now that we've moved PDF.js to WebKit).

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #0)
> It's an implementation detail of the website.

I meant to write: it's an implementation detail of WebKit, not something that the website could be expected to know about.

[Michael Catanzaro]

Patrick says we need to call LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy from somewhere. Not clear where would be the nicest place to do this, since it only needs to happen once, not once for each PDFDocument.

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #2)
> Patrick says we need to call
> LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy from
> somewhere. Not clear where would be the nicest place to do this, since it
> only needs to happen once, not once for each PDFDocument.

Well that was a dumb question. We should do it wherever we register the scheme.

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #3)
> Well that was a dumb question. We should do it wherever we register the
> scheme.

Well it's more complicated than this. The scheme is never actually explicitly registered anywhere. It's just hardcoded into LegacySchemeRegistry.cpp.

[Radar WebKit Bug Importer]

<rdar://problem/97938315>

[Patrick Griffis]

Pull request: https://github.com/WebKit/WebKit/pull/2922

[EWS]

Committed 253040@main (e9c47d55c988): <https://commits.webkit.org/253040@main>

Reviewed commits have been landed. Closing PR #2922 and removing active labels.