Noticed this when looking at the list of 500s, wmfwiki receives some malformed csp reports to which mediawiki replies with 500, IMO it should be a 400 since it is client-provided data we are trying to parse.
"message": "Error reading CSP report: wrongformat", "url": "/w/api.php?action=cspreport&format=none&reportonly=1&source=wmfwiki&", "method": "ApiCSPReport::verifyPostBodyOk", "channel": "csp-report-only", "reqId": "WSWDmQpAEDEAAULovFQAAADG",
| mediawiki/core : master | Return 400 on invalid CSP reports |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T28508 Content Security Policy (CSP) | |||
| Resolved | fgiunchedi | T166229 Mediawiki replies with 500 on wrongly formatted CSP report |
There's a code comment that says:
// 500 so it shows up in browser's developer console. $this->dieWithError( [ 'apierror-csp-report', wfEscapeWikiText( $code ) ], 'cspreport-' . $code, [], 500 );
Yes, 400 would seem to be more semantically appropriate than 500. I have no idea whether a 400 response also shows up in a browser's developer console.
@Anomie yeah I don't know either what would happen in that case, I think we can turn it into a 400 for now though. Will send a patch for mw-core.
Change 355757 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[mediawiki/core@master] Return 400 on invalid CSP reports
Change 355757 merged by jenkins-bot:
[mediawiki/core@master] Return 400 on invalid CSP reports
Mass-moving all items tagged for MediaWiki 1.30.0-wmf.3, as that was never released; instead, we're using -wmf.4.