Bug 259577 - [GTK] Website policies not applied in Epiphany when website is opened in new tab
Summary: [GTK] Website policies not applied in Epiphany when website is opened in new tab
Status: REOPENED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKitGTK (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-27 14:19 PDT by Jeff Fortin
Modified: 2024-06-13 14:18 PDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jeff Fortin 2023-07-27 14:19:32 PDT
With Epiphany 44.5 + WebKitGTK 2.40.3 + GStreamer 1.22.5 from Fedora 38, and the default "Media autoplay: Without sound" state, on Wayland GNOME,

1. Launch the browser
2. Open a private window (just to be sure)
3. Go to Youtube.com
4. Middle-click the title text of one of the videos there, so that it opens in a clean new tab
5. Do not click anything else, do not interact with any page element, just wait.

Result: the newly opened tab autoplays (with sound, even).

P.s.:
At step 4, instead of middle-clicking you could also simply left-click to load a new page replacing the current tab's contents; I used the new tab technique just to ensure that it wasn't a case where YouTube "fakes" loading a new page but actually just replaces the current page within the current tab, but apparently that's not the case.

I'd expect autoplay to work automagically only if a page is using WebRTC videoconferencing.
Comment 1 Philippe Normand 2023-07-28 03:23:11 PDT
What is this default "Media autoplay: Without sound" state you're talking about?
Comment 2 Philippe Normand 2023-07-28 03:27:38 PDT
When reporting bugs here, please check with MiniBrowser.

I'm unable to reproduce this issue in MiniBrowser.
Comment 3 Michael Catanzaro 2023-07-28 09:31:24 PDT
(In reply to Philippe Normand from comment #1)
> What is this default "Media autoplay: Without sound" state you're talking
> about?

WEBKIT_AUTOPLAY_ALLOW_WITHOUT_SOUND, corresponding to the "Media autoplay" permission in Epiphany's security popover

(In reply to Philippe Normand from comment #2)
> When reporting bugs here, please check with MiniBrowser.

Even I do not do this. :P MiniBrowser is awkward to use and it's really rare for a web content bug to turn out to be somehow caused by Epiphany.

That said, in this case it *might* be true, because I can reproduce this in Epiphany but not in MiniBrowser. MiniBrowser always uses WEBKIT_AUTOPLAY_ALLOW_WITHOUT_SOUND unless you pass a special command line flag. It does this by creating a WebKitWebsitePolicies and then using it to create each WebKitWebView. Epiphany does something completely different: it uses the default WebKitWebsitePolicies when creating the view, then applies a new set of policies for each navigation policy decision using webkit_policy_decision_use_with_policies(). Epiphany cannot follow the MiniBrowser approach because it allows the autoplay policy to be different for every website and so needs to apply new policies to every load. Still, I think it's *probably* a WebKit bug for the policies to not be applied successfully, so this is the best place for the bug report until we've dived in further.
Comment 4 Michael Catanzaro 2023-07-28 09:38:25 PDT
Looking closer, I think this actually is an Epiphany bug. decide_navigation_policy() in ephy-window.c ignores the policy decision when creating a new tab, which is correct, but then the WebKitWebsitePolicies never get applied. I think they need to be applied when creating the new tab, and then a later navigation policy decision should override them... right?

So Jeff, please do report this on Epiphany's issue tracker instead.
Comment 5 Michael Catanzaro 2023-07-28 12:12:29 PDT
Mm, well I changed my mind already. Reopening.

Epiphany really wants to set the WebKitWebsitePolicies only for the particular origin, which is what webkit_policy_decision_use_with_policies(). It does not want to set default policies for the entire web view. But it cannot call webkit_policy_decision_use_with_policies() because that will cause the load to occur in the current view. It really has to use webkit_policy_decision_ignore().

So I think this an API flaw. We need some other way to configure WebKitWebsitePolicies in this case.
Comment 6 Michael Catanzaro 2024-06-13 12:04:42 PDT
(In reply to Michael Catanzaro from comment #5)
> So I think this an API flaw. We need some other way to configure
> WebKitWebsitePolicies in this case.

I still believe this is true, but I can't reproduce the original problem on youtube.com anymore. I also found a useful test page https://videojs.github.io/autoplay-tests/ which also does not reproduce the problem. At first I thought the bug is hidden by the fact that website policies are applied during the initial navigation to the test page, but I ruled that out by copying the videojs test page to a local HTML file and replacing all the href attributes with https://videojs.github.io/ URLs. I can confirm that Epiphany never applies website policies for the domain (because there is no navigation when creating a new web view, and therefore no navigation policy decision), but the videos nevertheless do not autoplay. Maybe a user gesture is now required? (But why would that have changed within the past year?)

Anyway, although the problem with autoplay is mysteriously fixed, the fundamental problem here is not. Epiphany applies policies when handling *navigation* policy decisions because that's what the WebKitPolicyDecision documentation says to do. But an API requested load does not trigger a navigation policy decision, so Epiphany just fails to apply policies for new windows and new tabs.

My first thought was that we could fix this by applying website policies when handling *response* policy decisions instead, by checking if it's a main resource response. This is easy to do, and I *think* it's already supported by WebKit. We would just need to adjust the documentation of webkit_policy_decision_use_with_policies() to suggest this. At first I thought this was a great idea, but there is a problem: that's too late if the policy would affect the main resource load. That would be a problem immediately because we need to add HTTPS First and HTTPS Only policies in bug #274840. It would also matter for link decoration policy if we add that in the future. So this idea fails.

I think we need some API to tell WebKit to apply policies to the next API request load, whatever that is.
Comment 7 Michael Catanzaro 2024-06-13 14:18:25 PDT
Actually Epiphany does receive a policy decision when creating a new window. It's only when creating a new tab that there is there no navigation policy decision. Odd.