Bug 258602 – poster attribute for video element has stricter Mixed Content policies

• Component: Media
• Status: NEW

[Benjamin]

If you add a poster attribute to the video element it dosen't load the poster, but works fine in other browsers

<video poster="http://camendesign.com/code/video_for_everybody/poster.jpg">
  <source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4">
  <p>Your browser does not support the video tag.</p>
</video>

[Alexey Proskuryakov]

I cannot reproduce this with Safari 17 beta. There is something weird going on with the poster size, as it momentarily shows up having the same size as in Chrome, and then becomes smaller.

[Karl Dubost]

Created attachment 466857 [details]
rendering in safari, firefox, chrome

With 

```
data:text/html,<video poster="http://camendesign.com/code/video_for_everybody/poster.jpg"><source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"><p>Your browser does not support the video tag.</p></video>
```

Safari Technology Preview  173           19616.1.20.2
Firefox Nightly            116.0a1       11623.6.28
Google Chrome Canary       117.0.5859.0  5859.0


The behavior is totally different.

[Karl Dubost]

with the data: URL the console says:


Refused to load http://camendesign.com/code/video_for_everybody/poster.jpg because it does not appear in the img-src directive of the Content Security Policy.


which is interesting because 
data:text/html,<img src="http://camendesign.com/code/video_for_everybody/poster.jpg">

will work. 

https://searchfox.org/wubkat/rev/0a80aee13182b2feee32d8519e716edf3e876e18/Source/WebCore/html/HTMLVideoElement.cpp#249-262

[Karl Dubost]

Ha this is working.


data:text/html,<video poster="https://camendesign.com/code/video_for_everybody/poster.jpg"><source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"><p>Your browser does not support the video tag.</p></video>


aka https for the poster URL instead of http.

So the bug is different. It's more about Content Security Policy for the poster attribute.

[Alexey Proskuryakov]

To be clear, I was testing with a local file, containing the code from bug description.

[Benjamin]

I have updated the URL to a codepen illustrating the issue

https://codepen.io/benjaminhoegh/pen/NWEjPXE

[Radar WebKit Bug Importer]

<rdar://problem/111765501>

[Karl Dubost]

after discussions with Anne, it's more about mixed content.

[Anne van Kesteren]

In particular we should be upgrading this request, similar to <img src>.