2

I maintain a small website for a non-profit organization. Multiple pdfs are available for viewing on the website.

I’ve come across an issue with a pdf file display in the current version of Safari (v. 16.4) (under macOS Ventura) and have also now seen it in other WebKit browsers such as DuckDuckGo and Orion.

When the website server's Content Security Policy (CSP) contains style-src 'self', a link to open a pdf (stored in the website’s directory) results in the height of the pdf to be severely truncated to about 150 pixels.

Changing the CSP to include style-src 'self' 'unsafe-inline' results in the pdf being displayed as expected.

Safari 15.6.1 under macOS Catalina, Firefox and Google Chrome all display the pdf as expected without the addition of 'unsafe-inline' to style-src.

Is this a new WebKit bug or a purposeful change in the implementation of in-browser pdf display?

I’m aware of the security concerns of using 'unsafe-inline' in style-src. What alternative is available to circumvent this pdf display issue that I’ve noted (assuming it’s not a bug that will be fixed)?

1 Answer 1

1

I've found that Safari v. 17.0 running under macOS Ventura no longer shows the problematic display of a pdf file (that I reported in my initial query) when the host website server's Content Security Policy (CSP) contains style-src 'self'.

Relative to other WebKit browsers, the current version (v. 99.123-beta) of the Orion browser also displays the pdf as expected. However, the current version of the DuckDuckGo browser (v. 1.59.3) continues to incorrectly display a pdf when the website's CSP contains style-src 'self'.

I infer from this that updates to WebKit have fixed the pdf display issue and that the DuckDuckGo browser is using an older version of WebKit than is used by Safari and Orion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .