Attach (recommended) or Link to PDF file

PDFJS-JPEG2000-WebAssembly-Problem.pdf

Web browser and its version

FireFox 128.0, Edge 126.0.2592.102, Chrome 126.0.6478.183

Operating system and its version

Windows 11 Enterprise 22H2 22621.3880

PDF.js version

4.4.168

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

1. Have a Content-Security-Policy that does not allow usage of WebAssembly
2. Try to render the PDF file which has JPXDecode inside
3. The canvas stays blank and receive a warning on the console

What is the expected behavior?

The canvas should get painted and no console warnings should happen.
The problematic PDF file was renderable with PDFJS version 3.

What went wrong?

1. The canvas stays blank.
2. The browser console logs Warning: Unable to decode image "img_p0_1": "CompileError: WebAssembly.Module(): Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' *.company.tld"".

Link to a viewer

No response

Additional context

The PDF was renderable without problems with the same CSP with PDFJS version 3.11.174.

I am not allowed to adjust or weaken the CSP.

This is the CSP: default-src 'none'; script-src 'self' *.company.tld; connect-src 'self' *.company.tld; img-src 'self' blob: data: *.company.tld; frame-src 'self' *.company.tld; style-src 'self' 'unsafe-inline' *.company.tld; font-src 'self' *.company.tld; frame-ancestors 'self' *.company.tld; upgrade-insecure-requests;