Page MenuHomePhabricator

Abuse Filter Graphs on ptwikis.toolforge.org loads jquery from external website
Closed, ResolvedPublic

Description

(I hope this is the right place; https://github.com/ptwikis/ptwikis linked from https://tools.wmflabs.org/admin/tools offers no issue tracker. Also not sure who to subscribe to allow attention; I copied names from the page; please feel free to remove yourself.)

Steps to reproduce:

  1. Go to https://ptwikis.toolforge.org/Filters
  2. Enter language code and click "Go" button

Actual results:
On result page, see that <script src="//ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script> is in the source code.

Expected results:
Not loading content from a third-party server. Use https://tools-static.wmflabs.org/cdnjs/ajax/libs/jquery/1.11.1/jquery.min.js instead.

Event Timeline

It looks like there are quite a few other Content-Security-Policy violations for this tool: https://csp-report.toolforge.org/search?ft=ptwikis

It looks like there are quite a few other Content-Security-Policy violations for this tool: https://csp-report.toolforge.org/search?ft=ptwikis

Judging by the report from this tool, looks like the merged pull request was not synced to toolforge. Is that right @Danilo, @Alchimista ?

This merged fix is still not deployed.

Danilo claimed this task.

Fixed. I changed the code to not use JQuery.

There is a "Coordination/bug report" link in the side menu, I thought it was easy to find. I don't use more the github repository. The best way to find me is in IRC, I only saw this task because I have an IRC bot that relays wikibugs reports that have the term "ptwiki".