search

obsproject / obs-browser

CEF-based OBS Studio browser plugin
GNU General Public License v2.0
776 stars 220 forks source link

`web_security` setting no longer available as of CEF 90.1.0 #296

Closed deviant closed 3 years ago

deviant commented 3 years ago

Before you close this as invalid this isn't a bug report, it's a warning in advance; I just can't open a normal issue because I'm forced to fill in a form instead.

As of CEF 90.1.0 (targeting Chromium 90.0.4430.30), the web_security browser setting has been removed. It's being used in this plugin to allow accessing locally stored large media files, and thus will no longer be available as a fix once you upgrade to this version. The underlying issue may no longer exist in more recent versions of Chromium, or perhaps there's another way to work around this (a comment on the PR mentions file_access_from_file_urls and universal_access_from_file_urls, and offers a branch with the suggested fix). Either way, it would be nice not to weaken security here— browser engines have a very large attack surface, and you're already pinning an older version.

Cheers, V

RytoEX commented 3 years ago

Before you close this as invalid this isn't a bug report,

We only use GitHub Issues for verified bug reports, so yes, we'll be closing this.

We're aware that CEF has removed web_security in CEF 90 (Branch 4430). However, since we only really support using CEF 3770, 4183, and 4280 at this time, this is not an issue for us.

Incidentally, I'm the author of the branch you linked to. In all likelihood, we would swap to that solution if we find that large media files are still broken in builds of CEF that we support.

The underlying issue may no longer exist in more recent versions of Chromium

Indeed, we suspect the underlying issue may no longer exist in modern CEF builds (I think 77+ / Branch 3865+). From what I recall, we suspect changes to the NetworkService portion of CEF/Chromium had resolved it, though I may be mistaken.

We're in the process of updating our CEF versions across all platforms, but that is not as easy as one might think. The details of that process are here.

In the future, for communicating information that is not a bug report, feel free to reach out to us on Discord, IRC, or our forums.