PDF embedding

[SuruPa00]

There is an issue with embedding pdfs where even though the markdown code is correct, the pdf does not still show up in the LAMP account. See the "pdf tip" tip in the learn page of U1147188384 for an example.

[SuruPa00]

@ZCOEngineer let's have this looked at alongside priority 1 items now

[ZCOEngineer]

Ok Suraj

[sarithapillai8]

@SuruPa00
The pdf is not rendering as we are trying to render it inside sandboxed iFrame. There are some restrictions for security reasons. I hope we cannot remove that attribute.
@avaidyam Please confirm.

[avaidyam]

@sarithapillai8 It was working before and it's not working now. Can you provide explanation as to why the security policy is suddenly different? We have always been using a sandboxed iframe, correct?

[sarithapillai8]

@avaidyam
Yes we are using the same sandboxed iFrame. If it was working, was it given in the same way as given now? Because I can see that the sandboxed iFrame restrict the rendering of pdf with embed, object tags. All these working when I remove sandbox attribute

[avaidyam]

@sarithapillai8 Please add the sandbox exception attributes for plugins, external APIs, and automatically triggered content. That should fix the YouTube embed issue.

[sarithapillai8]

@avaidyam We already have exception attributes in sandbox. I can check further. If you have any suggestion, please let me know. Our code is like :
'sandbox="allow-forms allow-same-origin allow-scripts allow-popups allow-top-navigation "'

[avaidyam]

If that is the case, there should be no reason for PDF embedding to stop working. Can you investigate any code changes to React-Markdown in the Tips code?

[sarithapillai8]

@avaidyam
No code changes affecting this pdf rendering found. I wonder if this is something related with browser update. PDF is rendering in Firefox and safari browser. The chrome browser has restrictions with sandboxed IFrame.

[avaidyam]

@sarithapillai8 Good call - I've investigated this and found that you are correct, it is indeed a new Chrome 88+ bug and a new security policy change made around Sept./Oct. 2021.¹²³⁴

The Chrome PDF renderer now honors the global JavaScript policy (via chrome_pdf::features::kPdfHonorJsContentSettings). Chrome 88+ does not respect the Content-Security-Policy of the page for some reason as well and thus disables only PDF rendering inside an iframe.

Footnotes

1. https://bugs.chromium.org/p/chromium/issues/detail?id=413851 ↩

2. https://chromium.googlesource.com/chromium/src/+/48927999f8445cf01628dc3904a317e9d7a43964 ↩

3. https://github.com/whatwg/html/issues/3958 ↩

4. https://csplite.com/csp/test324/ ↩