issue with WebView in 8u202

Tue Nov 20 08:14:41 UTC 2018

Hi Arun,

Regarding   <meta http-equiv='Content-Security-Policy' content='img-src *;’/>
               -      In the above html snippet, CSP of img tag is set to load from all except file scheme. 

I think the above statement is not correct. For me it loads both file and https images with img-src *; (tested in hellowebview and chrome).  I guess  the reason why the 2nd image(https)  is not loaded with above code is there is a mismatch of backquote (’) for alt='from file:’
Also from spec [1]  img-src *; means  "Images may load from anywhere (note the "*" wildcard)."

I think to load from file: scheme, there is no need to specify explicitly in the CSP header (apart from "*" wild card)

Please correct me if im wrong.

Thanks,
Murali

-----Original Message-----
From: Arunprasad Rajkumar 
Sent: Tuesday, November 20, 2018 12:39 PM
To: Anton Tarasov <anton.tarasov at jetbrains.com>
Cc: openjfx-dev at openjdk.java.net
Subject: Re: issue with WebView in 8u202

Hi Anton,

Looks like this is mostly related to Content Security Policy(CSP)[1] which have got strengthened after recent WebKit upgrades.

I have reduced the given html further(PSB) & I could reproduce the problem with the following html snippet,

<html><head>
<meta http-equiv='Content-Security-Policy' content='img-src *;’/></head> <body> <img src='file:///Users/ARAJKUMA/Downloads/penguingun-900x900.jpg' alt='from file:’/> <img src='https://betanews.com/wp-content/uploads/2016/04/penguingun-900x900.jpg' alt=‘from http:’/> </body></html>

In the above html snippet, CSP of img tag is set to load from all except file scheme. It would load img from http: but not from file. If you also want to load from file: scheme, then you must explicitly set that in the CSP header. Something like below,

<html><head>
<meta http-equiv='Content-Security-Policy' content='img-src file: *;’/></head> <body> <img src='file:///Users/ARAJKUMA/Downloads/penguingun-900x900.jpg' alt='from file:’/> <img src='https://betanews.com/wp-content/uploads/2016/04/penguingun-900x900.jpg' alt=‘from http:’/> </body></html>

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Thanks,
Arun

> On 20-Nov-2018, at 10:04 AM, Anton Tarasov <anton.tarasov at jetbrains.com> wrote:
> 
> Thanks for the catch, Kevin! Seems very likely. Is it the thing configured at compile-time?
> 
> Regards,
> Anton.
> 
> On 11/20/2018 12:51 AM, Kevin Rushforth wrote:
>> I can reproduce it and it seems related to Cross-Site-Scripting (XSS) protections, which you have enabled in your HTML header with:
>> 
>>     <meta http-equiv="Content-Security-Policy" ...>
>> 
>> If I remove the 'http-equiv="Content-Security-Policy"' from the meta-data then it displays just fine.
>> 
>> Perhaps Arun or Murali could comment on whether this is a bug or not. It seems just as likely to me that it is a feature that didn't used to be enabled and now is.
>> 
>> -- Kevin
>> 
>> 
>> On 11/19/2018 1:44 PM, Anton Tarasov wrote:
>>> Hi Kevin,
>>> 
>>> On 11/20/2018 12:21 AM, Kevin Rushforth wrote:
>>>> Hi Anton,
>>>> 
>>>> We'll take a look and see if we can reproduce it. Am I correct in understanding that the problem only happens with loadContent, which works on 8u152 and fails on 8u202-ea? And that load from a file works fine on both 8u152 and 8u202-ea?
>>>> 
>>> Yes, that's right. I've also checked that it's broken in the latest jfx12 as well. I'd appreciate your help in resolving this.
>>> 
>>> Thanks,
>>> Anton.
>>> 
>>>> 
>>>> -- Kevin
>>>> 
>>>> 
>>>> On 11/19/2018 12:17 PM, Anton Tarasov wrote:
>>>>> Hello, JFX team!
>>>>> 
>>>>> We (at JetBrains) faced an issue with WebView after we've moved to an JFX update in JDK8u202. The issue is that WebView stopped loading images referenced by an absolute URL under some circumstances.
>>>>> 
>>>>> Below is a real html content, produced by IDEA markdown viewer. It has lots of style pre-loads and a sample image that it should eventually display. The html is loaded view WebEngine.loadContent(..) but a placeholder text is only displayed - that's the problem that can be reproduce with JDK8u202. However it worked with JDK8u152.
>>>>> 
>>>>> The style references will obviously fail for you, but if you put this html into a file and will load it via WebEngine.load(file:///path/to/file), the image will be shown with no problem (in 8u202 as well).
>>>>> 
>>>>> <html><head><meta http-equiv="Content-Security-Policy" 
>>>>> content="default-src 'none'; script-src 
>>>>> http://localhost:63344/api/markdown-preview/scripts/processLinks.j
>>>>> s?_ijt=ujioejund46k8cmdcsuggbpnf3 
>>>>> http://localhost:63344/api/markdown-preview/scripts/scrollToElemen
>>>>> t.js?_ijt=ujioejund46k8cmdcsuggbpnf3; style-src https: 
>>>>> http://localhost:63344/api/markdown-preview/styles/default.css?_ij
>>>>> t=ujioejund46k8cmdcsuggbpnf3 
>>>>> http://localhost:63344/api/markdown-preview/styles/darcula.css?_ij
>>>>> t=ujioejund46k8cmdcsuggbpnf3 
>>>>> http://localhost:63344/api/markdown-preview/styles/inline.css?_ijt
>>>>> =ujioejund46k8cmdcsuggbpnf3; img-src *; connect-src 'none'; 
>>>>> font-src *; object-src 'none'; media-src 'none'; child-src 
>>>>> 'none';"/><link rel="stylesheet" 
>>>>> href="http://localhost:63344/api/markdown-preview/styles/default.c
>>>>> ss?_ijt=ujioejund46k8cmdcsuggbpnf3" />
>>>>> 
>>>>> <script 
>>>>> src="http://localhost:63344/api/markdown-preview/scripts/processLi
>>>>> nks.js?_ijt=ujioejund46k8cmdcsuggbpnf3"></script>
>>>>> <script 
>>>>> src="http://localhost:63344/api/markdown-preview/scripts/scrollToE
>>>>> lement.js?_ijt=ujioejund46k8cmdcsuggbpnf3"></script></head><body 
>>>>> md-src-pos="0..89"><p md-src-pos="0..88"><img 
>>>>> src="file:///C:/Users/tav/IdeaProjects/DummyProject/src/kitten.jpg
>>>>> " alt="Kitten" title="A cute kitten" md-src-pos="0..88" 
>>>>> /></p></body></html>
>>>>> 
>>>>> Then, if you remove all the style loading and leave only the 
>>>>> image, the image will be shown in either way: load(url) or 
>>>>> loadContent (in 8u202)
>>>>> 
>>>>> <html><head></head><body md-src-pos="0..89"><p 
>>>>> md-src-pos="0..88"><img 
>>>>> src="file:///C:/Users/tav/IdeaProjects/DummyProject/src/kitten.jpg
>>>>> " alt="Kitten" title="A cute kitten" md-src-pos="0..88" 
>>>>> /></p></body></html>
>>>>> 
>>>>> Sorry for not submitting the code, I hope you will easily put it into a real demo (I played with JFX's WebViewApp).
>>>>> 
>>>>> So, could you please advice on what went wrong with it?
>>>>> 
>>>>> With regards,
>>>>> Anton.
>>>> 
>>> 
>> 
> 