Sandboxed iframe in the ViewHandler not rendering PDFs

[hsbarbosa]

Hey,
The new ViewHandler in v5.0 doesn't seem to be rendering pdfs either with Chrome or Safari.
Chrome 57.0.2987.133
Safari 10.1 (12603.1.30.0.34)

Actually it seems to be a security issue that was recently corrected but now they are not allowing sandboxed iframes to execute scripts. Apparently it's only when the pdf is loaded in a different tab.
Removing the sandbox directive from the iframe makes it render properly (but the iframe is sandboxed for a reason, I guess).

[takluyver]

The sandboxing is so that HTML files you view cannot talk to kernels the server is running - it should mean that cross-domain protection kicks in between the content in the iframe and the notebook server.

We do sandbox it with the allow-scripts flag, but maybe browsers aren't respecting that?

We should only need the sandboxing for files that can run code in the browser, like html and svg (?), so you can workaround this for a PDF by changing /view/ to /files/ in the URL. But PDF.js is probably complex enough that I'd have some reservations about letting it out of the sandbox by default, in case a malicious PDF can cause it to run Javascript and then talk to kernels.

[hsbarbosa]

That's what I thought.
Many thanks!
Cheers,

[gnestor]

I just submitted a PR to address this: #2449