Follow Content-Security-Policie guidance // Errors while loading js + css

Aperta
  • Qualcosa non va?
#405 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Ferma
Stack tecnologico
css, javascript, php
Ambito
frontend, security

Direzione di ricerca

Inizia dai punti di ingresso segnalati: main.js, load script:41, ServiceWorker.js, NotificationsApp.vue, icons.css e preview-service-worker.js. Riproduci i problemi di caricamento degli asset con CSP abilitato e traccia gli errori segnalati relativi a script, fogli di stile, chunk e service worker. Il lavoro è completato quando gli asset di sharelisting vengono caricati senza violazioni di CSP o errori di caricamento correlati.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Using Nextcloud 17.1 / and sharelisting 1.1.1 we see following issues in console.log.
This affects user performance, since loading issues will cause slow page loads after logging in.
Disabling CSP headers -> resovles this issues -> brings back the security concers :-)

image

Refused to load the script 'https://intranext.domain.de/apps/sharelisting/js/sharelisting-vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350.js?v=843769528916a0761446' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

o.l @ load script:41
load script:41 Refused to load the script 'https://intranext.domain.de/apps/sharelisting/js/sharelisting-sharing.js?v=1020b6e44ccaabbc7399' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

o.l @ load script:41
jsonp chunk loading:27 Uncaught (in promise) ChunkLoadError: Loading chunk vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350 failed.
(error: https://intranext.domain.de/apps/sharelisting/js/sharelisting-vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350.js?v=843769528916a0761446)
    at o.f.j (jsonp chunk loading:27:18)
    at ensure chunk:6:25
    at Array.reduce (<anonymous>)
    at o.e (ensure chunk:5:56)
    at main.js:33:2
index.es.js:2337 Proxying an event bus of version 3.1.0 with 1.3.0
e @ index.es.js:2337
NotificationsApp.vue:470 Notifications permissions not yet requested
workspace:1     Failed to load resource: the server responded with a status of 404 ()
intranext.domain.de/:1 Refused to apply style from 'https://intranext.domain.de/apps/sharelisting/css/icons.css?v=872ccd9c-14' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
ServiceWorker.js:31 Refused to create a worker from 'https://intranext.domain.de/index.php/apps/files/preview-service-worker.js' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.

(anonymous) @ ServiceWorker.js:31
core-common.js?v=d8a1abcc-14:sourcemap:2 [ERROR] files: SW registration failed:  {app: 'files', uid: 'CLotz', level: 2, error: DOMException: Failed to register a ServiceWorker: The provided scriptURL ('https://intranext.bkk-ru…}
Lingua principale
PHP
Stelle
20
Fork
8
Merge medio
7m
PR unite (30g)
1

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextcloud/sharelisting

Tutte le issue di nextcloud/sharelisting

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.