2

We receive mp3 voicemails in Gmail. Starting today, all computers using Google Chrome can't play mp3s found in Gmail. This doesn't affect other sites that host mp3s.

Upon further inspection, the console reports:

Refused to load media from 'https://mail.google.com/mail/u/...' because it violates the following Content Security Policy directive: "media-src https://*.googlevideo.com/videoplayback/".

Is Gmail not following its new CSP policies? Is any work around other than simply downloading and playing the files?

SILENT
  • 3,916
  • 3
  • 38
  • 57

2 Answers2

0

With the Content Security Policy directive media-src https://*.googlevideo.com/videoplayback/, media files from sources different to https://*.googlevideo.com/videoplayback/ can't be played in the <video>/<audio> tags embedded into page.
Even you load media by ajax and create <audio> tag with blob:-Url, it will be blocked by above CSP.
It's not a browser dependant, that's how CSP is work.

With the current CSP restrictions, mediafiles can be played only in the isolated browsing contexts like <iframe>/<object>/<embed>.

I don't know is GMail made it intentionally or occasionally, but only browser extensions using nested browsing contexts can play media in such conditions.

granty
  • 7,234
  • 1
  • 14
  • 21
  • It works on other non-chromium browsers like Firefox. I think a new CSP rule became active. – SILENT May 29 '21 at 18:50
  • Firefox supports the `media-src` directive the same way as Chrome. Therefore it possible only if GMail provides different CSP for Firefox and for Chrome. You can check actual CSP rules in the [Network tab](https://stackoverflow.com/questions/64060894/trouble-with-content-security-policy/64068629#64068629). – granty May 29 '21 at 21:00
0

In the end, I created a Chrome Extension with XMLHTTPRequest to get around CSP and to play the mp3 without a direct download.

I released a Chrome Extension called GPlayer. Waiting on Google to approve. I believe the future link is https://chrome.google.com/webstore/detail/obdmmgdlafadeehmbmcmoggnaokehnaj

Github link - https://github.com/TriStarGod/GPlayer

SILENT
  • 3,916
  • 3
  • 38
  • 57
  • Could you provide more detail? This is defiantly a bug as it breaks all media attachments. Would you provide the extension you built for the community to use? – JpaytonWPD Jun 04 '21 at 15:13
  • @JpaytonWPD I made the chrome extension, GPlayer, publically available. Waiting on Google to approve. – SILENT Jun 07 '21 at 16:24
  • I wonder if you will have any issue getting approved for circumventing their security. Hopefully it gets approved, this is such a pita. – JpaytonWPD Jun 07 '21 at 16:33
  • Your plugin is approved, but not working for me. I am however playing a wav file, not an MP3. Would you be willing to post the source code on github so we can collaborate. – JpaytonWPD Jun 08 '21 at 11:54
  • @JpaytonWPD I added wav support. It worked on some sample wavs I found online. Also, made GPlayer public. – SILENT Jun 08 '21 at 15:58
  • Figured it out, the plugin only works in the email viewer. If you click an attachment from the inbox directly you still get the error. Which is fine, solves the issue. – JpaytonWPD Jun 12 '21 at 19:55
  • I don't want a plugin for this, Google must fix it! It worked up to version 93, so this answer certainly isn't the solution to the question. – basZero Jun 24 '21 at 05:59