Images missing in Release Notes on vscode.dev in Safari

[alexdima]

(initially reported in #142490 (comment) by @osortega)

• in Safari
• open https://vscode.dev
• Help > Release Notes

Appears to be caused by CSP errors:

[mjbvz]

Extension pages are also broken. I suspect this is because script are disabled in both of these webviews, however I don't understand why this also ends up breaking other stuff. Markdown previews and image preview (both of which have scripts enabled) also work fine. The CSP errors suggest that safari is ignoring the inner most CSP which explicitly allows all the blocked resources.

Both cases work fine on Chrome and firefox

[mjbvz]

This is caused by this block of code:

vscode/src/vs/workbench/contrib/webview/browser/pre/main.js

Line 871 in c713056

if (!options.allowScripts && isSafari) {

This block was added to work around a different limitation on Safari (https://bugs.webkit.org/show_bug.cgi?id=33604) and removing the if condition causes the iframes never to load.

---

As part of this investigation, I noticed that the content does sometimes load so it looks like a race condition. After testing, I also determined this happens in Chrome too.

I've opened two bugs to track this:

• https://bugs.chromium.org/p/chromium/issues/detail?id=1297377
• https://bugs.webkit.org/show_bug.cgi?id=236624

The fact that two browsers are flakey here suggests were are doing something crazy, but I don't have enough knowledge to say if we're truly going against the specs. Will see if I can workaround this better, even if that means simply adding another timeout for safari loads

[rzhao271]

The release notes don't load at all for me now.
I get the following error in the console:
Error while parsing the 'sandbox' attribute: 'allow-downloads' is an invalid sandbox flag.

[mjbvz]

Fixed in stable and in 1.65 branch by #144133

[rzhao271]

Still seeing a bunch of errors. Not sure if the changes are in, yet. Sent over a log.

[rzhao271]

Ok it's good now 🎉