-
Notifications
You must be signed in to change notification settings - Fork 186
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
*JavaScript* no longer working in latest builds of Chrome App #615
Comments
I dug into this a bit. A couple of comments:
We did tighten up some security items recently and I suspect that may be the cause and/or Chrome did so. @danielweck Any comments? |
I downloaded the new version of the user's book, which though it now passes EPUBCheck, still raises the same exceptions in Chrome. The new version is here @danielweck Any comments? |
Interesting thread on Stackoverflow here |
@danielweck |
I am now suspecting this is some Chrome issue/restriction for packaged apps. If I run the HTML in the Chrome browser directly, the popups work fine. But I cannot find any executable (CRX) that doesn't cause the exception to be thrown. But all of the CRXes are executing with my current Chrome engine, 57.0.2987.133 |
IMPORTANT |
Tested with the CloudReader here and the EPUB Test Suite 102 passes, so it appears that the problem is restricted to the Chrome app. The Chrome dev blog says they fixes "several" security problems, one critical and 9 high, but they don't say what. |
I found this page: It includes a list of security bugs fixed, including: [$1000][669086] Medium CVE-2017-5033: Bypass of Content Security Policy in Blink. Credit to Nicolai Grødum But if I try to follow the link to get more details I am told I do not have the permission to view the page. |
Andrew Gribben commented: The way I read it Readium would need to white list the origin (blob or filesystem in this case?) in order for the in-line script to execute, but when a script is loaded from an external file using an EventListener then it should work as planned (I think). |
I have now created two simple EPUB test-files, |
Well, inline scripts were always disabled due to Chrome app Content Security Policy ... but it is possible that a more recent build of Chrome plugged a loophole in their iframe implementation. By the way, this CSP restriction is the reason why we had to inject the RequireJS config script directly into the single-file AMD bundle (which contains the Almond loader). See: https://github.com/readium/readium-js-viewer/blob/master/src/chrome-app/index.html#L27 <head>
...
<script type="text/javascript" src="scripts/readium-js-viewer_all_CHROMEAPP.js"> </script>
<!-- script type="text/javascript" src="scripts/requirejs-config.js"> </script -->
</head> paths:
{
...
"readium_js_viewer_RJS-CONFIG":
process._RJS_rootDir(3) + '/src/chrome-app/requirejs-config',
...
}, |
@danielweck Hm. I see in the article referenced above:
Seems like this suggests that we can somehow "white list" or "bless" inline content? Or is this what @ryanackley meant when he said "Readium is a packaged app. Unlike extensions, you can't change the inline script CSP" |
Useful info for this discussion, perhaps: https://developer.chrome.com/webstore/apps_vs_extensions |
Exactly. |
But it's not clear to me that even if we reverted to a "pure" extension that it would solve our problem. Or is it that we could, as an extension, modify the CSP behaviour so that inline scripts would be allowed?
But that's a lot of ifs... |
@rkwright , @danielweck , am planning to look into this during this Easter break and possibly come up with a more radical fix. Took a swing at it last Sunday, but failed building it with Node 7, therefore I now need to set up a Docker just for this running Node 6. |
Ended up using NVM, builds fine with Node 6.10.2, which brings me to a list of issues:
The way I see going forward is a sans HTTP implementation of Readium. Working directly from the file system would have benefits such as:
|
Thanks @attilavago |
There is an existing Electron implementation of ReadiumJS in this feature branch: https://github.com/readium/readium-js-viewer/tree/feature/electron |
@attilavago Thanks! I would agree with the benefits you outline. This direction is, I am afraid, probably our only viable course. The problems include having to migrate hundreds of thousands of users from their currently library to a new one having to test all that and then shepherd the users to a new solution. Far from trivial. I've done this before (Adobe Digital Editions when I ran the eBook group at Adobe). It can be a nightmare, even with a dedicated QE team - which Readium does not have. |
The Electron feature branch ( https://github.com/readium/readium-js-viewer/tree/feature/electron ) is a naive (but working) port of the Chrome app, in the sense that the HTML5 FileSystem storage backend is unchanged (as it works perfectly fine in the open-source Chromium engine, as it does in Google's Chrome browser). |
Thankfully (for all) Chrome Apps are on their way out--in favor of the Web:
So it seems this is heading the right direction with a move to Electron (or similar). Sadly @rkwright is likely right about the migration cost/process: "The problems include having to migrate hundreds of thousands of users from their currently library to a new one having to test all that and then shepherd the users to a new solution." I'm still new enough here to not know what all that entails, but wanted to stop by an 👍 the move to something webbier than Chrome Apps (for many reasons). 😃 |
For your information: exelearning/iteexe#258 |
This issue is a Bug
Related issue(s) and/or pull request(s)
None
Expected Behaviour
When clicked, the links in the document should pop up a little note. The user maintains that this worked in previous versions (not yet verified)
Issue was reported on the forum here
Observed behaviour
Instead, nothing happens.
Steps to reproduce
Test file(s)
See above
Product
Additional information
Sort of works in iBooks but the note is clipped, user reports it works fine gitden on Android
The text was updated successfully, but these errors were encountered: