Some styling broken in Firefox 149

[cg505]

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser: Firefox 149
• Local OS: Arch Linux
• Remote OS: Arch Linux (same machine)
• Remote Architecture: amd64
• code-server --version: 4.112.0 d7599ae with Code 1.112.0

Steps to Reproduce

1. Open a markdown file preview.

Expected

A stylesheet (markdown.css) should load and style the preview correctly.

Actual

The preview is not styled properly.

Logs

Browser network tab shows SSL_ERROR_BAD_CERT_DOMAIN - see Firefox bug.

Screenshot/Video

No response

Does this bug reproduce in native VS Code?

No, this works as expected in native VS Code

Does this bug reproduce in VS Code web?

I did not test VS Code web

Does this bug reproduce in GitHub Codespaces?

No, this works as expected in GitHub Codespaces

Are you accessing code-server over a secure context?

• I am using a secure context.

Notes

This is a regression in Firefox 149. I reported the bug upstream.
https://bugzilla.mozilla.org/show_bug.cgi?id=2029029

It is also observable in some other contexts, e.g. styling for the Claude Code extension.

Observed in a setup with a secure context and also over localhost.

[MicahZoltu]

This appears to be a Firefox bug that is being worked on and hopefully will go out in an upcoming release, but I'm curious why VSCode/CodeServer are routing requests to a fake CDN and then intercepting them?

[code-asher]

Might be better asked to the VS Code folks, but I think normally the web view base HTML is fetched from their CDN (to provide a different origin for security reasons, is my assumption). The interception is required to then fetch the real content to avoid cross-origin requests.

In code-server we patch the base HTML to be fetched locally rather than rely on Microsoft's CDN but left the rest. Last I checked (quite a while ago though) the iframe was created in such a way as to have no origin so the constraints still applied, but it might make sense to choose a different fake URL.