mirrors/pdf.js
1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2025-04-21 15:48:06 +02:00
Code Activity

Allow local PDF files to be viewed in local frames

Browse source 
The Chrome extension enforces that local files cannot be embedded in
non-local web pages. The previous check was too strict (because the
origin of a file:-URL is "null"), and prevented local PDF from being
viewed in local files).

This patch fixes that problem, by querying the actual tab URL via the
background page.

Steps to verify:
1. Create a HTML file: `<iframe src=test.pdf width=100% height=100%>`
2. Build and load the extension.
3. Allow file access to the extension at `chrome://extensions`
4. Open the HTML file from a file:// URL.
5. VERIFY: The extension should attempt to load the PDF file.

6. Now open the following (replace ID with the extension ID, which you
   can find at `chrome://extensions`):
  `data:text/html,<iframe src="chrome-extension://ID/file:///test.pdf">`
7. VERIFY: The next error should be displayed:
   "Refused to load a local file in a non-local page for security reasons."
This commit is contained in:
Rob Wu 2016-01-30 14:21:54 +01:00
parent 5d797e1a85
commit 0ec82d4a50
2 changed files with 58 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

43
web/chromecom.js
View file

@ -113,18 +113,25 @@ var ChromeCom = (function ChromeComClosure() {
return;
}
if (/^file?:/.test(file)) {
if (top !== window && !/^file:/i.test(location.ancestorOrigins[0])) {
PDFViewerApplication.error('Blocked ' + location.ancestorOrigins[0] +
' from loading ' + file + '. Refused to load a local file in a ' +
' non-local page for security reasons.');
return;
}
isAllowedFileSchemeAccess(function(isAllowedAccess) {
if (isAllowedAccess) {
PDFViewerApplication.open(file);
} else {
requestAccessToLocalFile(file);
getEmbedderOrigin(function(origin) {
// If the origin cannot be determined, let Chrome decide whether to
// allow embedding files. Otherwise, only allow local files to be
// embedded from local files or Chrome extensions.
// Even without this check, the file load in frames is still blocked,
// but this may change in the future (https://crbug.com/550151).
if (origin && !/^file:|^chrome-extension:/.test(origin)) {
PDFViewerApplication.error('Blocked ' + origin + ' from loading ' +
file + '. Refused to load a local file in a non-local page ' +
'for security reasons.');
return;
}
isAllowedFileSchemeAccess(function(isAllowedAccess) {
if (isAllowedAccess) {
PDFViewerApplication.open(file);
} else {
requestAccessToLocalFile(file);
}
});
});
return;
}
@ -132,6 +139,20 @@ var ChromeCom = (function ChromeComClosure() {
});
};
function getEmbedderOrigin(callback) {
var origin = window === top ? location.origin : location.ancestorOrigins[0];
if (origin === 'null') {
// file:-URLs, data-URLs, sandboxed frames, etc.
getParentOrigin(callback);
} else {
callback(origin);
}
}
function getParentOrigin(callback) {
ChromeCom.request('getParentOrigin', null, callback);
}
function isAllowedFileSchemeAccess(callback) {
ChromeCom.request('isAllowedFileSchemeAccess', null, callback);
}