Conversation
#1939) [HOTFIX] Bool-parse ENABLE_HIGHLIGHT_API_DEPLOYMENT env var (#1937) [FIX] Bool-parse ENABLE_HIGHLIGHT_API_DEPLOYMENT env var os.environ.get returns the raw string when the variable is set, so ENABLE_HIGHLIGHT_API_DEPLOYMENT="False" was truthy in Python (any non-empty string is truthy). Wrap in CommonUtils.str_to_bool so "False" / "false" / "0" actually evaluate to False. The setting is consumed by the cloud configuration plugin's spec default (ConfigSpec.default in plugins/configuration/cloud_config.py) on cloud and on-prem builds. With this fix, an admin who explicitly sets the env var to a falsy string sees highlight data stripped as expected. Co-authored-by: vishnuszipstack <117254672+vishnuszipstack@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Frontend Lint Report (Biome)✅ All checks passed! No linting or formatting issues found. |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Cache: Disabled due to Reviews > Disable Cache setting Knowledge base: Disabled due to Summary by CodeRabbit
WalkthroughThe PR contains two independent configuration updates: converting an environment variable to a proper boolean in backend settings, and switching the frontend nginx Content Security Policy header from enforcement to reporting-only mode. ChangesBackend Environment Variable Boolean Conversion
Frontend CSP Header Mode
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Contributor
Test ResultsSummary
Runner Tests - Full Report
SDK1 Tests - Full Report
|
Contributor
|
| Filename | Overview |
|---|---|
| frontend/nginx.conf | CSP enforcement header replaced with report-only mode, removing all XSS blocking; also adds cdn.jsdelivr.net to connect-src. |
| backend/backend/settings/base.py | Bug fix: ENABLE_HIGHLIGHT_API_DEPLOYMENT now uses CommonUtils.str_to_bool to correctly handle string env var values (e.g., "false" was previously truthy). |
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
frontend/nginx.conf:51
**CSP Downgraded to Report-Only Mode**
Switching from `Content-Security-Policy` to `Content-Security-Policy-Report-Only` removes all CSP enforcement — the browser will only log violations and no longer block them. This means XSS payloads that the previous policy would have blocked (e.g., inline script injection, unauthorized `connect-src` destinations) will now execute freely. If this is a temporary debugging measure for a hotfix, it should be time-boxed and reverted promptly, as it weakens the application's primary XSS defense.
Reviews (1): Last reviewed commit: "[HOTFIX] Bool-parse ENABLE_HIGHLIGHT_API..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # - PostHog, GTM, reCAPTCHA, Stripe, Product Fruits: third-party services | ||
| add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://eu.i.posthog.com https://eu-assets.i.posthog.com https://www.googletagmanager.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://js.stripe.com https://app.productfruits.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://eu.i.posthog.com https://eu-assets.i.posthog.com; font-src 'self' data:; connect-src 'self' blob: wss: https://eu.i.posthog.com https://eu-assets.i.posthog.com https://www.google-analytics.com https://api.stripe.com https://app.productfruits.com; frame-src 'self' https://www.google.com/recaptcha/ https://recaptcha.google.com https://js.stripe.com https://hooks.stripe.com; worker-src 'self' blob: https://unpkg.com https://cdn.jsdelivr.net; object-src 'none'; base-uri 'self'; form-action 'self' https://checkout.stripe.com; frame-ancestors 'self'" always; | ||
| # CSP in report-only mode: logs violations to browser console without blocking requests. | ||
| add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://eu.i.posthog.com https://eu-assets.i.posthog.com https://www.googletagmanager.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://js.stripe.com https://app.productfruits.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://eu.i.posthog.com https://eu-assets.i.posthog.com; font-src 'self' data:; connect-src 'self' blob: wss: https://cdn.jsdelivr.net https://eu.i.posthog.com https://eu-assets.i.posthog.com https://www.google-analytics.com https://api.stripe.com https://app.productfruits.com; frame-src 'self' https://www.google.com/recaptcha/ https://recaptcha.google.com https://js.stripe.com https://hooks.stripe.com; worker-src 'self' blob: https://unpkg.com https://cdn.jsdelivr.net; object-src 'none'; base-uri 'self'; form-action 'self' https://checkout.stripe.com; frame-ancestors 'self'" always; |
Contributor
There was a problem hiding this comment.
Switching from Content-Security-Policy to Content-Security-Policy-Report-Only removes all CSP enforcement — the browser will only log violations and no longer block them. This means XSS payloads that the previous policy would have blocked (e.g., inline script injection, unauthorized connect-src destinations) will now execute freely. If this is a temporary debugging measure for a hotfix, it should be time-boxed and reverted promptly, as it weakens the application's primary XSS defense.
Prompt To Fix With AI
This is a comment left during a code review.
Path: frontend/nginx.conf
Line: 51
Comment:
**CSP Downgraded to Report-Only Mode**
Switching from `Content-Security-Policy` to `Content-Security-Policy-Report-Only` removes all CSP enforcement — the browser will only log violations and no longer block them. This means XSS payloads that the previous policy would have blocked (e.g., inline script injection, unauthorized `connect-src` destinations) will now execute freely. If this is a temporary debugging measure for a hotfix, it should be time-boxed and reverted promptly, as it weakens the application's primary XSS defense.
How can I resolve this? If you propose a fix, please make it concise.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Why
How
Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)
Database Migrations
Env Config
Relevant Docs
Related Issues or PRs
Dependencies Versions
Notes on Testing
Screenshots
Checklist
I have read and understood the Contribution Guidelines.