Gestures no longer work in PDFs

[ryanbr]

Describe your matter in detail

Mouse gestures no long work on pdfs (pdf.js) in Firefox nightly.

Install/Use Firefox nightly.
Visit; https://news.ycombinator.com/item?id=16797947
Click on the pdf link at the top
Wait for it to load, try to use a gesture to move back. No work.

Edit by Itchiii:
Firefox Version: 61.0a1 (Nightly)

[Itchiii]

It seems like it's up to Firefox. The screenshot tool of Firefox also does not work anymore.
But it's probably not the same problem as #258. The CSP header is not set.

[ryanbr]

This was a recent change from what I see. as in, the last few weeks.

[Itchiii]

The problem already exists with version 60.0

[Robbendebiene]

To give an update:
Mozilla is already aware of this problem: https://bugzilla.mozilla.org/show_bug.cgi?id=1456485

[ryanbr]

Did some regression checks, https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c8514e653b71479ba22a307f58f79f563ed80e9d&tochange=07ab807639ee42a407a9bdb0d374206c0f17678d this is where it broke.

[ryanbr]

looking through the #1456485 ticket, seems Gesturefy needs to change (like Screenshots) for this to be fixed now

[Robbendebiene]

It looks like this behavior won't be changed in the near future according to this bug.

[maxsu]

A rather dodgy workaround: Part 1

1. Use the Google PDF Viewer extension.
2. Curse under your breath
3. Gestures work now

This extension sends pdf urls directly to Google Doc's PDF viewer, and so preserves content script injection. This approach fails with readers based on Extension Pages (like Literal PDF Reader).

Disclaimer: I have no idea about the security of this approach!

A rather dodgy workaround: Part 2

1. Steal a web-hosted implementation of pdf.js, such as this one by @giuseppeg; add support for a pdf query string. (sandbox)

   Example: https://tnds0.codesandbox.io/?pdf=https://arxiv.org/pdf/1307.7118.pdf

2. Redirect pdf URLs to your custom PDF viewer endpoint (while cursing)

   Redirector entry:

{
    "description": "PDF Redirector",
    "exampleUrl": "https://arxiv.org/pdf/1307.7118.pdf",
    "exampleResult": "https://tnds0.codesandbox.io/?pdf=https://arxiv.org/pdf/1307.7118.pdf",
    "error": null,
    "includePattern": "(^https?://.*\\.pdf$)",
    "excludePattern": "",
    "patternDesc": "",
    "redirectUrl": "https://tnds0.codesandbox.io/?pdf=$1",
    "patternType": "R",
    "processMatches": "noProcessing",
    "disabled": false,
    "appliesTo": [
        "main_frame"
    ]
}

3. Gestures work now

Needless to say, this could be EVEN WORSE from a security standpoint.

Next steps

1. Incorporate a nicer pdf.js interface, like this one from Mozilla's pdf.js demo. This is the pdf.js interface we know and love.
2. Openly weep when a malicious pdf hijacks the page.

[Robbendebiene]

It seems unlikely that Firefox/Mozilla will ever allow extensions to run inside the pdf reader. Therefore I'm closing this issue.