Page MenuHomePhabricator

Wikimedia documentation unavailable: js blocked due to CSP
Closed, ResolvedPublic

Description

Some JSduck pages are stopping around at loading status.

I guess this caused by T213223#5485220 ( gerrit:535895 67a56304bf643d22e4bf17fb9c8556817cd7fb41 ) patch.

ext-all.js:38 Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline' 'self'".

    at ext-all.js:38
    at ext-all.js:38
app-0c945a27f43452df695771ddb60b3d14.js:1 Uncaught DOMException: Failed to read the 'localStorage' property from 'Window': The document is sandboxed and lacks the 'allow-same-origin' flag.
    at https://doc.wikimedia.org/mediawiki-core/master/js/app-0c945a27f43452df695771ddb60b3d14.js:1:87555
/mediawiki-core/master/js/#!/api/mw.log:29 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

/mediawiki-core/master/js/#!/api/mw.log:202 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-YFOIjkCvZnAH6R5z1ZjUI/Zgf7uslK5vN80+lsdvYss='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

/mediawiki-core/master/js/#!/api/mw.log:228 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-YFOIjkCvZnAH6R5z1ZjUI/Zgf7uslK5vN80+lsdvYss='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

/mediawiki-core/master/js/#!/api/mw.log:382 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-YFOIjkCvZnAH6R5z1ZjUI/Zgf7uslK5vN80+lsdvYss='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

/mediawiki-core/master/js/#!/api/mw.log:388 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-ZdHxw9eWtnxUb3mk6tBS+gIiVUPE3pGM470keHPDFlE='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

(index):395 Refused to load the stylesheet 'https://fonts.googleapis.com/css?family=Exo' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'style-src-elem' was not explicitly set, so 'default-src' is used as a fallback.

(anonymous) @ (index):395
ext-all.js:38 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-NA53hEXOaRihI3snNzt5Py1z3tG03mlAJTnJb5dEfKI='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

init @ ext-all.js:38
ext-all.js:38 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-h6i66sWae7FQraJgPKZtike2U9kbdj6H4ef+hLRvI4A='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

init @ ext-all.js:38
ext-all.js:38 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-isBg57oda5bvrrCI5oPumlJGNwD3CMfczbHEtuIAmiw='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

init @ ext-all.js:38
ext-all.js:38 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-cUtUA2GBdi4dtncTW7Pr5W2p1T9OmZosgcgFNgCzPx0='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

init @ ext-all.js:38
ext-all.js:38 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-fFRHI5PNmrz9bPtAXUqdfDkfYAkipB2P2SyE1YJJrZc='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

init @ ext-all.js:38
ext-all.js:38 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-S7ZenpTBT8dynfQlRZPwQtcqoidonYHPhVhFGs8telY='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

init @ ext-all.js:38
ext-all.js:38 Uncaught TypeError: Cannot read property 'get' of undefined
    at Object.Ext.get (ext-all.js:38)
    at Object.Ext.apply.getBody (ext-all.js:38)
    at b (ext-all.js:38)
    at ext-all.js:38
    at h.fire (ext-all.js:38)
    at h.Ext.apply.readyEvent.e.fire (ext-all.js:38)
    at fireReadyEvent (ext-all.js:38)
    at ext-all.js:38
/mediawiki-core/master/js/extjs/src/Ajax.js?_dc=1568257411834:1 Failed to load resource: the server responded with a status of 404 ()
/mediawiki-core/master/js/extjs/src/util/Cookies.js?_dc=1568257411835:1 Failed to load resource: the server responded with a status of 404 ()
/mediawiki-core/master/js/extjs/src/app/Controller.js?_dc=1568257411839:1 Failed to load resource: the server responded with a status of 404 ()
/mediawiki-core/master/js/extjs/src/data/Store.js?_dc=1568257411840:1 Failed to load resource: the server responded with a status of 404 ()
/mediawiki-core/master/js/extjs/src/container/Container.js?_dc=1568257411837:1 Failed to load resource: the server responded with a status of 404 ()
/mediawiki-core/master/js/extjs/src/panel/Panel.js?_dc=1568257411837:1 Failed to load resource: the server responded with a status of 404 ()
/mediawiki-core/master/js/#!/api/mw.log:1 Refused to load the stylesheet 'https://fonts.googleapis.com/css?family=Exo' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'style-src-elem' was not explicitly set, so 'default-src' is used as a fallback.

Event Timeline

Rxy triaged this task as High priority.Sep 12 2019, 3:17 AM
Rxy added a project: Documentation.
jcrespo renamed this task from JSDuck is now unavailable due to loading external resources failed to Wikimedia documentation unavailable: js blocked due to CSP.Sep 12 2019, 8:51 AM
jcrespo added subscribers: Jdoggs91, Rxy, Dzahn and 3 others.

I have repurposed @Rxy patch to use Content-Security-Policy-Report-Only instead of reverting. This way we at least get the logs and can finely tweak the rules.

https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/535987
Change doc.wikimedia CSP header to report only

hashar assigned this task to Rxy.

The header has been turned to Content-Policy-Security-Report-Only. https://doc.wikimedia.org/oojs-ui/master/js/ works again, sorry :-\

Is there a reason that this task should remain non-public? Duplicate https://phabricator.wikimedia.org/T232704 is also public.

Is there a reason that this task should remain non-public? Duplicate https://phabricator.wikimedia.org/T232704 is also public.

@Aklapper - no, everything on the task is public and/or not sensitive.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".Sep 12 2019, 3:22 PM
DannyS712 subscribed.

[batch] remove patch for review tag from resolved tasks