Refused to load the image on simulator 3.7.5 - (2017.3.824.1)

[Daniel]

Cordova version 4.0.0
In the simulator from visual studio when trying to display images that has been saved to the filesystem an error is displayed:
Refused to load the image 'file:///C:/xxx/Telerik/Icenium/Simulator/Storage/Temp…filename.jpg' because it violates the following Content Security Policy directive: "img-src * data: 'unsafe-inline'".
The meta tag is:
<meta http-equiv="Content-Security-Policy"content="default-src *; style-src 'self' 'unsafe-inline';
          script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com; img-src * data: 'unsafe-inline'" />

And it worked with the same meta-tag before the update in version 3.7.4 (2017.2.504.6)

Also the underlying chrome browser version seems to have been changed from 3.7.4 to 3.7.5 in the simulator. Could this affect this? It was not in the release notes but I noticed it when checking the debugger in the simulator.

[Daniel]

Added an image showing the error message.

Highlighted the tabs showing that it is a new chrome version.

[Garo]

Hello Daniel,

Yes, the underlying Chrome version of the device simulator was changed in our latest release. We received several reports that the configuration settings of the DevTools are not persisted between sessions and we decided to update the Chromium Embedded Framework (CEF) which is used in the simulator. We have noted this resolved issue in our release notes. Based on your question, I believe that the correct course of action would have been to notify our users of the major change as well and I will forward this information to the people responsible for handling the documentation.

Having said that, this seems to be a limitation of the new version of CEF. We will investigate this further to determine if we can provide a viable workaround.

In the meantime, does removing the img-src directive from the CSP resolves the issue, as this would be the easiest workaround?

Regards,
Garo
Progress Telerik

 

 

[Daniel]

Removing the img-src from the CSP has no effect since then it uses the default-src with directive * and that does not seem to work either.

Linking directly to an image on the harddrive in an img tag used to work before (I could select any image on my harddrive to display in the simulator, not just in the temporary storage folder).

I made a few tests and the simulator seems able to load images from internet sources but whenever trying to load from the filesystem it fails. A filesystem image can be loaded if it is opened in a new window (inappbrowser) but not shown immediately in a view. Also assets from within the project folder works without problems.

The compiled app in a device is able to display images from the device's filesystem however, so it works in iOS and android, but this is not ideal since we need to debug and style in the simulator...

Please look into the issue! I'm sure more people have problems with this.

[DanielSingle]

Hello!

This is a severe issue for us. We need to be able to easily downgrade to the previous version of AppBuilder. Please explain how we do this or release a new version based on the old version of Chrome or with a fix on the new version of Chrome. We currently do not have the time to speculate in different types of "workarounds".

Changing the underlying Chrome-version in the simulator seems like an odd thing to do between version 3.7.4 and 3.7.5.

With Regards

Daniel Gerhardson

WSP

http://www.wsp.com/

[Garo]

Hello Daniel,

I understand how important it is to be able to access the file system from the simulator. Unfortunately, this is a limitation in the new version of the embedded framework used for the simulator. We are currently investigating if it is possible to fix this on our end or we have to report the issue to the CEF development team.

The update to the underlying Chrome-version of the simulator was planned for 3.7.0 and was postponed several times for additional fixes. We cannot revert the last update as this will negate all those fixes and in addition, it has a high chance to cause further regression in the simulator. Furthermore, you cannot use an older version of AppBuilder as it will not work with the updated version of our server and you will not be able to open your app or test it in the simulator at all. Until we have additional information on the issue, I am afraid that I can only suggest workarounds. 

Having said that, does the issue persist if you remove the entire Content Security Policy or you are able to see the image?

Regards,
Garo
Progress Telerik