UploadWizard has a feature that allows user to import images from Flickr.
With the feature enabled, UploadWizard will connect to https://api.flickr.com and violate CSP if https://api.flickr.com is not specifically defined under $wgCSPHeader.
Instead, UploadWizard should add the Flickr API to CSP if the feature is being used.
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Flickr: Add flick url to CSP directives | TheDJ | mediawiki/extensions/UploadWizard | master | +7 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | sbassett | T249486 Change Content Security Policy on betacommons to allow api.flickr.com | |||
| Resolved | TheDJ | T278472 UploadWizard should add Flickr API to Content Security Policy when required |
This is currently allowed under the enforcing CSP within Wikimedia production: https://github.com/wikimedia/operations-mediawiki-config/blob/35f7e4c45a33a22f171c721d6c24d18f127d36fb/wmf-config/InitialiseSettings.php#L12892-L12969. But that may not always be the case. Regardless, this is an exception that will likely always require some kind of work-around.
IIUC from this task's description, it's asking for the UploadWizard extension itself to add the Flickr API to a site's Content-Security-Policy, rather than for the Flickr API to be specifically allowlisted within Wikimedia's own custom CSP.
I'm therefore boldly reopening this task, as I don't believe that this is yet the case. (Although, FWIW, I believe @TheDJ's pending patch at https://gerrit.wikimedia.org/r/248981 might go some-or-all of the way towards achieving what's described/requested in this task).
On the subject of this task itself, it may also be worth noting that live.staticflickr.com may be another endpoint that may need to be added to a site's CSP for UploadWizard's Flickr functionality to work properly/fully (xref T419263#11683585).
(Though I'm not personally sure how stable that domain-name may or may not be... if e.g. Flickr decides to change their CDN's domain-name at some point, would this necessitate a patch to UploadWizard to also add that new domain to CSP?)
Change #1248981 had a related patch set uploaded (by TheDJ; author: TheDJ):
[mediawiki/extensions/UploadWizard@master] Flickr: Add flick url to CSP directives
Change #1248981 merged by jenkins-bot:
[mediawiki/extensions/UploadWizard@master] Flickr: Add flick url to CSP directives
Yes that's correct.
The Flickr API is only used within some pages under UploadWizard, the extension should be responsible for adding the CSP only to the pages that require it.