Audio/video player is blank in 6.5a2

A blog commenter writes: Previous builds would have a dark background with simple controls for video or audio playback. There are no longer visible controls for video/audio, just a blank white background, and I cannot view statistics or seek. Same behavior from local files [mp3/4].

I can reproduce this. The player plays but there are no controls; in the case of an audio file this means the whole page is blank. It works as expected in 6.0.3.

Try these example URLs: https://archive.org/download/OrsonWellesMrBruns/381030.ogg (audio) https://extra.torproject.org/blog/2016-08-PT-animation/pluggable_transports-animation.mp4 (video)

Here is how the audio player looks in 6.0.3: And in 6.5a2 it's just blank:

added TorBrowserTeam201608R component::applications/tor browser owner::tbb-team parent::8725 priority::medium resolution::fixed severity::normal status::closed tbb-regression type::defect labels

Trac:

Screenshot of audio player in 6.0.3.

Trac:

Screenshot of audio player in 6.5a2.

More information: https://blog.torproject.org/blog/tor-browser-65a2-released#comment-197036 Image display also seems to be affected; I've only tried .jpg & .png so far. Image is on white/blank background, not centered & in the Inspector UI's CSS pane [Rules:element {shrinkToFit} does not seem to be available or is a bit wonky, in addition to other styles], no magnifying glass icon (however zoom does work).

Trac:
Keywords: N/A deleted, tbb-regression, TorBrowserTeam201608 added

Another data point: I can reproduce this with 6.5a2 on an OSX 10.11.6 system (nut not with 6.0.3).

Disabling Torbutton fixes the problem, but I have not investigated further.

Trac:
Cc: N/A to brade, mcs

This is caused by the #8725 (moved) changes. Specifically, these resources are blocked by our shouldLoad() implementation: chrome://global/content/TopLevelVideoDocument.js re/gre/res/TopLevelVideoDocument.css chrome://global/skin/media/TopLevelVideoDocument.css chrome://global/content/bindings/videocontrols.xml I do not know how to fix this; the request origin is the content document's URL (e.g., https://ia600201.us.archive.org/1/items/OrsonWellesMrBruns/381030.ogg)

Trac:
Cc: brade, mcs to brade, mcs, yawning

A more complete list (along with the type is):

    // Video playback.
    "chrome://global/content/TopLevelVideoDocument.js": Ci.nsIContentPolicy.TYPE_SCRIPT,
    "resource://gre/res/TopLevelVideoDocument.css": Ci.nsIContentPolicy.TYPE_STYLESHEET,
    "chrome://global/skin/media/TopLevelVideoDocument.css": Ci.nsIContentPolicy.TYPE_STYLESHEET,
    "chrome://global/content/bindings/videocontrols.xml": Ci.nsIContentPolicy.TYPE_XBL,
    "chrome://global/content/bindings/scale.xml": Ci.nsIContentPolicy.TYPE_XBL,
    "chrome://global/content/bindings/progressmeter.xml": Ci.nsIContentPolicy.TYPE_XBL,

    // Image display.
    "resource://gre/res/ImageDocument.css": Ci.nsIContentPolicy.TYPE_STYLESHEET,
    "resource://gre/res/TopLevelImageDocument.css": Ci.nsIContentPolicy.TYPE_STYLESHEET,
    "chrome://global/skin/media/TopLevelImageDocument.css": Ci.nsIContentPolicy.TYPE_STYLESHEET,

    // Resizing text boxes.
    "chrome://global/content/bindings/resizer.xml": Ci.nsIContentPolicy.TYPE_XBL,

It's tempting to start whitelisting things that are required for various pieces of functionality, which does work. However:

• That at a minimum exposes information regarding Browser version.
• Is probably somewhat fragile and would require people keeping track of what internal URLs Firefox uses for various pieces of functionality.
• Realistically Mozilla should fix resource and chrome URIs correctly, though given how long the bug has languished on bugzilla, my bet is that it will remain ignored and unloved till Sol evolves into a Red Giant, rendering the issue moot by extinguishing all human life.

Branch that does just that available on request, though it probably should be security slider linked because it is a functionality/privacy tradeoff, and I'm completely out of fucks to give at this point.

Trac:
Parent: N/A to #8725 (moved)

Trac:
Username: nord-stream
Cc: brade, mcs, yawning to brade, mcs, yawning, nord-stream@ochaken.jp.eu.org

Trac:
Cc: brade, mcs, yawning, nord-stream@ochaken.jp.eu.org to brade, mcs, yawning, nord-stream@ochaken.jp.eu.org, arthuredelstein

Branch that does just that available on request.

And per discussion on IRC.

https://git.schwanenlied.me/yawning/torbutton/commit/eb7ad18e69e629e1229fe78a71b2f58e651fdf62

Our research: https://discourse.mozilla-community.org/t/how-to-determine-the-mime-type-of-the-loading-document-in-a-content-policy/9917?u=desktopd

Any ideas?

Trac:
Username: nord-stream

Trac:
Keywords: TorBrowserTeam201608 deleted, TorBrowserTeam201608R added
Status: new to needs_review

Fixed by commit 61b395a433c821bd4b17f69b956eb149f12f525e on master, thanks.

Trac:
Resolution: N/A to fixed
Status: needs_review to closed

closed

mentioned in issue #20701 (moved)

mentioned in issue #22104 (moved)