Page MenuHomePhabricator

Loading scripts or stylesheets from https://tools-static.wmflabs.org/cdnjs/ generates CSP warning
Closed, InvalidPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • In the browser console on an English Wikipedia page, enter one of the following:
    • mw.loader.load('https://tools-static.wmflabs.org/cdnjs/ajax/libs/select2/4.0.13/css/select2.min.css', 'text/css');
    • mw.loader.getScript('https://tools-static.wmflabs.org/cdnjs/ajax/libs/select2/4.0.13/js/select2.min.js');

What happens?:
An error message like one of the following is produced:

Loading the stylesheet 'https://tools-static.wmflabs.org/cdnjs/ajax/libs/select2/4.0.13/css/select2.min.css' violates the following Content Security Policy directive: "style-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org wikimedia.org 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback. The policy is report-only, so the violation has been logged but no further action has been taken.
Loading the script 'https://tools-static.wmflabs.org/cdnjs/ajax/libs/select2/4.0.13/js/select2.min.js' violates the following Content Security Policy directive: "script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org 'unsafe-inline' auth.wikimedia.org". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The policy is report-only, so the violation has been logged but no further action has been taken.

What should have happened instead?:
Script or stylesheet should load without producing an error, and wmflabs.org should be one of the domains listed.

Other information (browser name/version, screenshots, etc.):
Opening this as a separate bug per the advice in T419237

Event Timeline

Did functionality break, or are you just noting the error in the console? The error messages describe that these are report-only violations, so no further action was taken besides logging it.

We may adjust our report only policy, but at least right now, it is expected that the report only set is stricter, so that we continue to get a sense of volume of usage. These reports are how we calibrate our CSP policy to understand real-world use and minimize breakage.

Aklapper changed the task status from Open to Stalled.Mar 16 2026, 10:29 AM

@Ahecht: Could you please answer the last comment? Thanks in advance!

Sorry. The script appears to work (there may be a slowdown, or it could be my imagination), it just clogs up the console.

sbassett claimed this task.
sbassett triaged this task as Medium priority.
sbassett moved this task from Waiting to Our Part Is Done on the Security-Team board.
sbassett moved this task from Backlog to Done on the ContentSecurityPolicy board.
Aklapper renamed this task from Loading scripts or stylesheets from https://tools-static.wmflabs.org/cdnjs/ generates CSP error to Loading scripts or stylesheets from https://tools-static.wmflabs.org/cdnjs/ generates CSP warning.Mar 16 2026, 3:23 PM
Aklapper changed the task status from Resolved to Invalid.
Aklapper removed sbassett as the assignee of this task.
Aklapper added a subscriber: sbassett.