5 ms·

This WontFix made me sad [0]: > Yes, this is accurate - extensions cannot intercept requests from PDFium. PDFium, in Chrome, is (partially) implemented as a c

This WontFix made me sad [0]: > Yes, this is accurate - extensions cannot intercept requests from PDFium. PDFium, in Chrome, is (partially) implemented as a component extension, and extension requests cannot be monitored or manipulated by other extensions. The behavior of protecting component extension requests is critical for security reasons, and we are unlikely to change it. Ug, not exactly sure what triggers PDFium vs PDF download, but this is especially bad if I could load a PDF in an iframe and get around any of your ad blocking. I also question why it's considered an extension at the user level. Anything installed and enabled by default should be considered part of the core browser and not an extension (regardless of the mechanisms, such as the extension one, they are implemented with). I understand the levels of separation and implementation difficulty fixing this entails, I really do, but the practicalities of your on-by-default PDF renderer making web requests different than a web page is too bad to ignore. This goes to show that you can not count on extensions to filter web requests in your browser. You must do it at the network level or have a dedicated browser for it (e.g. Tor Browser). Unfortunately it's often extensions that have all the contextual information needed to make the decisions you want. 0 - https://bugs.chromium.org/p/chromium/issues/detail?id=824705#c4 https://bugs.chromium.org/p/chromium/issues/detail?id=824705...

deleted 8y ago
[deleted]
sp332 8y ago
In Firefox, add-ons aren't allowed to modify built-in pages either, like settings pages. At least they do seem to work on PDFs.
- tomvangoethem 8y ago
  The main reason why the issue isn't present in Firefox is because their PDF reader (PDF.js) does not have an API to trigger requests (it does execute JS included within the PDF though)
- tim1994 8y ago
  It depends. Extensions cannot modify or do anything with the content of a PDF tab (I wanted to make a PDF dark mode extension). I wish there were special permissions for that.
smallnamespace 8y ago
One can imagine building a hierarchy of permissions so some extensions can have higher privileges over others. One more step in the slow march of browsers taking on more functionality of an OS.
- saidajigumi 8y ago
  Not-so-tounge-in-cheek corollary: software with a sufficiently rich and desirable attack surface will evolve to become indistinguishable from an OS.
  - bigiain 8y ago
    "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can." -- jwz
    - drb91 8y ago
      I don’t get this quote. Why is mail reading considered an obvious forward step for a program? That fad seemed to die with the browser Mozilla (or SeaMonkey these days, if it still exists).
      - bigiain 8y ago
        Heh - for the record, that quote is from the guy who's responsible for open-sourcing Netscape into Mozilla, and is from around about that time/era... These days I wonder if the functional equivalent is expanding to include a Slack-bot?
        sneak 8y ago
        Facebook expanded until it could send and receive facebook walled garden mail (fb messages). iOS has iMessage. Instagram and tinder and snapchat all support the basic concept of “mail”. In fact, I wonder how many apps I have installed that don’t have some concept of an “inbox” or “messages”. Taskrabbit, Uber, GrubHub - all do “mail” in the modern, unfederated sense of the term. (email started out unfederated, then we got uucp and smtp, now we are back to unfederated, centralized messaging.)
bla2 8y ago
Reading that bug, it sounds like it was fixed in https://chromium.googlesource.com/chromium/src/+/51cd319fd6aac5ff056fa323d7072b917a7b1a7b https://chromium.googlesource.com/chromium/src/+/51cd319fd6a... and the bug status is just incorrect?
- kodablah 8y ago
  That appears to be for blocking JS (and opt-in only via disabling JS on the site hosting the PDF). I am unfamiliar w/ the internals of PDFs (especially concerning JS invocation), but can you request an image from a third party site without scripting? Also, what if I want the PDF's features to work and I just want to filter web requests like I do every other page out there (e.g. to remove the referrer header)? That web requests in PDF content types are not subject to the same approach as web requests in HTML content types is the problem. Disabling all JS is a blunt instrument akin to telling someone that being able to disable JS for other webpages is as good as more nuanced ad block extension.
  - ldarby 8y ago
    You seem to be in favour of some JS running but not other JS - how can software tell the difference? What do you mean by "nuanced ad block extension"? Do they just have a massive blacklist of bad actors to block?
    - kodablah 8y ago
      > You seem to be in favour of some JS running but not other JS No, sorry if I was unclear. What I'm in favor of is my extensions being able to handle/filter web requests on PDFs the same as they do for webpages, irrespective of JS settings. JS is only under discussion here because of the linked commit and I'm saying that's not good enough.
      - ldarby 8y ago
        Ok, anyway I agree with that completely, which is why I disabled PDFs opening automatically and have to click to open (via a standlone reader, not browser plugin). It's basically the same situation as the bad old days of having Flash load automatically and it making whatever requests it wants...
johnchristopher 8y ago
> Ug, not exactly sure what triggers PDFium vs PDF download, [..] A combination of MIME types on the server and which application the browser is configured to use for a given extension.
- Rjevski 8y ago
  It's determined by the "Content-Disposition" header in the response. If the header says it's an "attachment" then the browser will trigger a download, otherwise it's displayed inline.
  - johnchristopher 8y ago
    Thanks for the correction !
  - AndrewDucker 8y ago
    Unless you use an Addon like https://addons.mozilla.org/en-GB/firefox/addon/always-preview-webextension/ https://addons.mozilla.org/en-GB/firefox/addon/always-previe...

deleted 8y ago

[deleted]

sp332 8y ago

In Firefox, add-ons aren't allowed to modify built-in pages either, like settings pages. At least they do seem to work on PDFs.

tomvangoethem 8y ago
The main reason why the issue isn't present in Firefox is because their PDF reader (PDF.js) does not have an API to trigger requests (it does execute JS included within the PDF though)
tim1994 8y ago
It depends. Extensions cannot modify or do anything with the content of a PDF tab (I wanted to make a PDF dark mode extension). I wish there were special permissions for that.

smallnamespace 8y ago

One can imagine building a hierarchy of permissions so some extensions can have higher privileges over others. One more step in the slow march of browsers taking on more functionality of an OS.

saidajigumi 8y ago
Not-so-tounge-in-cheek corollary: software with a sufficiently rich and desirable attack surface will evolve to become indistinguishable from an OS.
- bigiain 8y ago
  "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can." -- jwz
  - drb91 8y ago
    I don’t get this quote. Why is mail reading considered an obvious forward step for a program? That fad seemed to die with the browser Mozilla (or SeaMonkey these days, if it still exists).
    - bigiain 8y ago
      Heh - for the record, that quote is from the guy who's responsible for open-sourcing Netscape into Mozilla, and is from around about that time/era... These days I wonder if the functional equivalent is expanding to include a Slack-bot?
      - sneak 8y ago
        Facebook expanded until it could send and receive facebook walled garden mail (fb messages). iOS has iMessage. Instagram and tinder and snapchat all support the basic concept of “mail”. In fact, I wonder how many apps I have installed that don’t have some concept of an “inbox” or “messages”. Taskrabbit, Uber, GrubHub - all do “mail” in the modern, unfederated sense of the term. (email started out unfederated, then we got uucp and smtp, now we are back to unfederated, centralized messaging.)

bla2 8y ago

Reading that bug, it sounds like it was fixed in https://chromium.googlesource.com/chromium/src/+/51cd319fd6aac5ff056fa323d7072b917a7b1a7b https://chromium.googlesource.com/chromium/src/+/51cd319fd6a... and the bug status is just incorrect?

kodablah 8y ago
That appears to be for blocking JS (and opt-in only via disabling JS on the site hosting the PDF). I am unfamiliar w/ the internals of PDFs (especially concerning JS invocation), but can you request an image from a third party site without scripting? Also, what if I want the PDF's features to work and I just want to filter web requests like I do every other page out there (e.g. to remove the referrer header)? That web requests in PDF content types are not subject to the same approach as web requests in HTML content types is the problem. Disabling all JS is a blunt instrument akin to telling someone that being able to disable JS for other webpages is as good as more nuanced ad block extension.
- ldarby 8y ago
  You seem to be in favour of some JS running but not other JS - how can software tell the difference? What do you mean by "nuanced ad block extension"? Do they just have a massive blacklist of bad actors to block?
  - kodablah 8y ago
    > You seem to be in favour of some JS running but not other JS No, sorry if I was unclear. What I'm in favor of is my extensions being able to handle/filter web requests on PDFs the same as they do for webpages, irrespective of JS settings. JS is only under discussion here because of the linked commit and I'm saying that's not good enough.
    - ldarby 8y ago
      Ok, anyway I agree with that completely, which is why I disabled PDFs opening automatically and have to click to open (via a standlone reader, not browser plugin). It's basically the same situation as the bad old days of having Flash load automatically and it making whatever requests it wants...

johnchristopher 8y ago

> Ug, not exactly sure what triggers PDFium vs PDF download, [..] A combination of MIME types on the server and which application the browser is configured to use for a given extension.

Rjevski 8y ago
It's determined by the "Content-Disposition" header in the response. If the header says it's an "attachment" then the browser will trigger a download, otherwise it's displayed inline.
- johnchristopher 8y ago
  Thanks for the correction !
- AndrewDucker 8y ago
  Unless you use an Addon like https://addons.mozilla.org/en-GB/firefox/addon/always-preview-webextension/ https://addons.mozilla.org/en-GB/firefox/addon/always-previe...