Synapse's new CSP breaks viewing transferred PDFs in Chrome #8605
Assignees
Labels
Comments
|
(p1 because high profile users are getting bitten by this) |
|
I think the conclusion here is that we should just force them to download |
turt2live
added a commit
to matrix-org/matrix-react-sdk
that referenced
this issue
Mar 29, 2019
Fixes element-hq/element-web#8605 The grey screen of sadness comes up when Chrome tries to open the PDF but doesn't have the right CSP headers. To avoid this, we'll just force a download of the PDF through `fetch` and `Blob`. There are a few cases where the user might still get a grey screen though: namely if they open the URL in a new tab or when the event content is lying about the file type, or the file is too large to blobify. `fetch` works in Chrome, Firefox, and our packaged Electron version.
turt2live
added a commit
to matrix-org/matrix-react-sdk
that referenced
this issue
Mar 29, 2019
Fixes element-hq/element-web#8605 The grey screen of sadness comes up when Chrome tries to open the PDF but doesn't have the right CSP headers. To avoid this, we'll just force a download of the PDF through `fetch` and `Blob`. There are a few cases where the user might still get a grey screen though: namely if they open the URL in a new tab or when the event content is lying about the file type, or the file is too large to blobify. `fetch` works in Chrome, Firefox, and our packaged Electron version.
turt2live
added a commit
to matrix-org/matrix-react-sdk
that referenced
this issue
Mar 29, 2019
Fixes element-hq/element-web#8605 The grey screen of sadness comes up when Chrome tries to open the PDF but doesn't have the right CSP headers. To avoid this, we'll just force a download of the PDF through `fetch` and `Blob`. There are a few cases where the user might still get a grey screen though: namely if they open the URL in a new tab or when the event content is lying about the file type, or the file is too large to blobify. `fetch` works in Chrome, Firefox, and our packaged Electron version.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
matrix-org/synapse#4284 added "sandbox" to the media repo's CSP. This was to stop certain attachment classes being able to get at the DOM when being viewed in a tab launched from riot.
However, empirically it means that PDFs are no longer visible in Chrome - you get a big grey page, and have to know to hit 'File Save' to save the actual attachment. Instead, we should either improve the CSP so it doesn't affect PDFs (which weren't the target we were protecting from), or special-case PDFs in Riot so they are downloaded immediately as attachments.
The text was updated successfully, but these errors were encountered: