Follow Content-Security-Policie guidance // Errors while loading js + css

未关闭
  • 哪里不对？
#405 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
需要澄清
活跃度
停滞
技术栈
css, javascript, php
领域
frontend, security

调研方向

从报告的入口点开始：main.js、load script:41、ServiceWorker.js、NotificationsApp.vue、icons.css 和 preview-service-worker.js。在启用 CSP 的情况下重现资源加载失败，并跟踪报告的脚本、样式表、chunk 和 service worker 错误。当 sharelisting 资源加载时不再出现 CSP 违规或相关加载错误，即表示完成。

由索引模型根据 Issue 内容生成。

描述

Using Nextcloud 17.1 / and sharelisting 1.1.1 we see following issues in console.log.
This affects user performance, since loading issues will cause slow page loads after logging in.
Disabling CSP headers -> resovles this issues -> brings back the security concers :-)

image

Refused to load the script 'https://intranext.domain.de/apps/sharelisting/js/sharelisting-vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350.js?v=843769528916a0761446' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

o.l @ load script:41
load script:41 Refused to load the script 'https://intranext.domain.de/apps/sharelisting/js/sharelisting-sharing.js?v=1020b6e44ccaabbc7399' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

o.l @ load script:41
jsonp chunk loading:27 Uncaught (in promise) ChunkLoadError: Loading chunk vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350 failed.
(error: https://intranext.domain.de/apps/sharelisting/js/sharelisting-vendors-node_modules_nextcloud_axios_dist_index_js-node_modules_nextcloud_router_dist_index_j-181350.js?v=843769528916a0761446)
    at o.f.j (jsonp chunk loading:27:18)
    at ensure chunk:6:25
    at Array.reduce (<anonymous>)
    at o.e (ensure chunk:5:56)
    at main.js:33:2
index.es.js:2337 Proxying an event bus of version 3.1.0 with 1.3.0
e @ index.es.js:2337
NotificationsApp.vue:470 Notifications permissions not yet requested
workspace:1     Failed to load resource: the server responded with a status of 404 ()
intranext.domain.de/:1 Refused to apply style from 'https://intranext.domain.de/apps/sharelisting/css/icons.css?v=872ccd9c-14' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
ServiceWorker.js:31 Refused to create a worker from 'https://intranext.domain.de/index.php/apps/files/preview-service-worker.js' because it violates the following Content Security Policy directive: "script-src 'nonce-UHgrYmtnbGIyOEJQRHFQS2JjeFJsd09hVmdyd2FiNWxFTDdqNGNVRCtuQT06VDN6Zi9VRXhyYU1yTitqaFhLOHAvbXJmT1htMEl2SWRWTldzczROSGxDZz0='". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.

(anonymous) @ ServiceWorker.js:31
core-common.js?v=d8a1abcc-14:sourcemap:2 [ERROR] files: SW registration failed:  {app: 'files', uid: 'CLotz', level: 2, error: DOMException: Failed to register a ServiceWorker: The provided scriptURL ('https://intranext.bkk-ru…}
主要语言
PHP
星标
20
派生
8
平均合并
7 分钟
30 天内合并 PR
1

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

nextcloud/sharelisting 的其他 Issue

查看 nextcloud/sharelisting 的全部 Issue

相似的 Issue

更多 PHP Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。