Follow Content-Security-Policie guidance // Errors while loading js + css

Abierto
  • ¿Algo no está bien?
#405 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Estancado
Stack tecnológico
css, javascript, php
Área
frontend, security

Línea de trabajo

Comienza con los puntos de entrada indicados: main.js, load script:41, ServiceWorker.js, NotificationsApp.vue, icons.css y preview-service-worker.js. Reproduce los fallos de carga de recursos con CSP habilitado y rastrea los errores indicados de scripts, hojas de estilo, chunks y service workers. Se considera terminado cuando los recursos de sharelisting se carguen sin infracciones de CSP ni errores de carga relacionados.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Using Nextcloud 17.1 / and sharelisting 1.1.1 we see following issues in console.log.
This affects user performance, since loading issues will cause slow page loads after logging in.
Disabling CSP headers -> resovles this issues -> brings back the security concers :-)

image

Refused to load the script 'https://intranext.domain.de/apps/sharelisting/js/sharelisting-vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350.js?v=843769528916a0761446' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

o.l @ load script:41
load script:41 Refused to load the script 'https://intranext.domain.de/apps/sharelisting/js/sharelisting-sharing.js?v=1020b6e44ccaabbc7399' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

o.l @ load script:41
jsonp chunk loading:27 Uncaught (in promise) ChunkLoadError: Loading chunk vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350 failed.
(error: https://intranext.domain.de/apps/sharelisting/js/sharelisting-vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350.js?v=843769528916a0761446)
    at o.f.j (jsonp chunk loading:27:18)
    at ensure chunk:6:25
    at Array.reduce (<anonymous>)
    at o.e (ensure chunk:5:56)
    at main.js:33:2
index.es.js:2337 Proxying an event bus of version 3.1.0 with 1.3.0
e @ index.es.js:2337
NotificationsApp.vue:470 Notifications permissions not yet requested
workspace:1     Failed to load resource: the server responded with a status of 404 ()
intranext.domain.de/:1 Refused to apply style from 'https://intranext.domain.de/apps/sharelisting/css/icons.css?v=872ccd9c-14' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
ServiceWorker.js:31 Refused to create a worker from 'https://intranext.domain.de/index.php/apps/files/preview-service-worker.js' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.

(anonymous) @ ServiceWorker.js:31
core-common.js?v=d8a1abcc-14:sourcemap:2 [ERROR] files: SW registration failed:  {app: 'files', uid: 'CLotz', level: 2, error: DOMException: Failed to register a ServiceWorker: The provided scriptURL ('https://intranext.bkk-ru…}
Lenguaje dominante
PHP
Estrellas
20
Forks
8
Merge medio
7 min
PR fusionados (30 d)
1

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de nextcloud/sharelisting

Todos los issues de nextcloud/sharelisting

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.