GitLab

Previously, when the user has a disabled PDF plugin (or no PDF plugin)
and the website has an IFRAMEed PDF, when Click to Open PDF was enabled,
we would inject a fake <object> tag into the IFRAME to force a PDF
plugin placeholder to appear.

This approach is problematic with CSP, as CSP may forbid OBJECT tags
from loading in IFRAMEs.

This CL instead injects the placeholder HTML directly into the IFRAME.

In the IFRAME case, the button is now a plain link, which should allow
the user to click it and download the PDF even if CSP forbids <object>
tags or JavaScript.

It still may trigger a CSP warning if IFRAME is prohibited from running
JavaScript, but that only hurts keyboard-accessibility, and doesn't
prevent the mainstream use case from working.

This CL also prevents the <object> tag from auto-opening the PDF after
download, which was probably a mistake, since that overrides the user
configurable "Always open with system viewer" option.

Bug: 887752, 879149, 878871
Change-Id: I900c08331d2cfc96ea7cd1cd46ea594445b0920b
Reviewed-on: https://chromium-review.googlesource.com/c/1246956Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#597192}