Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WebAssembly CSP Error Not Handled Properly - Only Shows Console Warning #1169

Open
shaulnaim opened this issue Jan 5, 2025 · 0 comments
Open

Comments

@shaulnaim
Copy link

Bug Report or Feature Request (mark with an x)
- [ ] Regression (a behavior that used to work and stopped working in a new release)
- [X ] Bug report -> please search issues before submitting
- [ ] Feature request
- [ ] Documentation issue or request

Description:
When a PDF requires WebAssembly and is blocked by Content Security Policy (CSP), the viewer only shows a console warning without triggering any error handlers or providing user feedback.

Current Behavior:

  1. When loading a PDF that requires WebAssembly functionality
  2. If CSP blocks WebAssembly with unsafe-eval restriction
  3. Only a console warning appears:
Warning: Unable to decode image "img_p0_1": "CompileError: WebAssembly.Module(): Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive..."
  1. No error event is emitted
  2. No way to catch this and show user feedback
  3. PDF viewer shows blank page with no error indication

Expected Behavior:

  • Error should be thrown or error event emitted when WebAssembly is blocked by CSP
  • Allow error handling through the standard (error) output
  • Enable developers to show appropriate error messages to users

Impact:

  • Poor user experience as users see blank PDFs without explanation
  • No way to gracefully handle this error case in production environments with strict CSP
  • Forces developers to implement hacky workarounds or modify worker code

Technical Details:

  • Occurs in PDF.js worker
  • Warning is logged in warn() function but doesn't propagate to error handlers
  • Affects environments where CSP restricts unsafe-eval

Suggested Solution:
Convert the WebAssembly CSP warning into a proper error that can be caught through the standard error handling mechanism.

Let me know if you would like me to add or modify anything in this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant