[tbb-bugs] #26540 [Applications/Tor Browser]: Enabling pdfjs disableRange option prevents pdfs from loading

[Tor Bug Tracker & Wiki]

#26540: Enabling pdfjs disableRange option prevents pdfs from loading
---------------------------------------------+-----------------------------
 Reporter:  pospeselr                        |          Owner:  pospeselr
     Type:  defect                           |         Status:
                                             |  needs_revision
 Priority:  Medium                           |      Milestone:
Component:  Applications/Tor Browser         |        Version:
 Severity:  Normal                           |     Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201810R  |  Actual Points:
Parent ID:                                   |         Points:
 Reviewer:                                   |        Sponsor:
---------------------------------------------+-----------------------------
Changes (by arthuredelstein):

 * status:  needs_review => needs_revision


Comment:

 I wonder if we could use Firefox's standard approach to passing around
 origin attributes inside the "principal". Currently, in the
 {{{
 download(data, sendResponse)
 }}}
 function definition in `PdfStreamConverter.jsm`, the channel is created as
 {{{
     var netChannel = NetUtil.newChannel({
       uri: blobUri,
       loadUsingSystemPrincipal: true,
     });
 }}}
 but I think we could change this to:
 {{{
     var netChannel = NetUtil.newChannel({
       uri: blobUri,
       loadingPrincipal: this.domWindow.document.nodePrincipal,
     });
 }}}

 I haven't tested this, but I expect it would result in
 {{{
   channel.loadInfo.originAttributes.firstPartyDomain
 }}}
 returning the document's firstPartyDomain, as needed in torbutton domain
 isolator. With this approach (assuming it works) we wouldn't need to alter
 channel classes in Firefox or patch torbutton.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26540#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online