Static files don't loading within CSP-restrictions

[just-boris]

Content-Security-Policy is gonna be spreading across the web. So it is matters to make Allure work with it.

Allure doesn't work with the following headers:

Content-Security-Policy:sandbox; default-src 'none'; img-src 'self'; style-src 'self’;

[just-boris]

Ok, reproduced it on my local server. It seems that our report can't work in the so strict environment.

I will look for more suitable compromise.

[just-boris]

Now I have come up with the conclusion that we can't make Allure work in such restrictions. That CSP setting disallows executing any javascript on the page. Obviously, our report can't work with JS.

I made Allure work with a bit relaxed version of config:

'Content-Security-Policy', "sandbox allow-scripts allow-same-origin; default-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self'; style-src 'self';"

It allows us to use all static resources from the same domain and fetch data via AJAX as well.

//cc @georgecrawford

[georgecrawford]

@just-boris Do you know anything about how the CSP settings are configured in Jenkins? According to our systems engineer, we're using a very vanilla installation of Jenkins, with nothing special security-wise. Does Allure definitely work for you in a similar setup?

If you know how I can change the headers, please let me know.

[just-boris]

Found the following commit: jenkinsci/jenkins@d3fb2c0
Looks like latest Jenkins version has this feature. I will try to figure out a way to opt-out that feature, because it makes impossible work of Allure

[georgecrawford]

Interesting - I'll also look into how we might configure this better.

[georgecrawford]

Ref: https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

[georgecrawford]

OK, so using this command in the Script Console:

System.setProperty(hudson.model.DirectoryBrowserSupport.class.getName() + ".CSP", "script-src 'unsafe-inline' 'self';")

... I have it almost working. But there's something very strange that I don't understand - lots of UI elements seem corrupted, and there are thousands of JS console errors (Error: [$interpolate:interr])

• both expand and collapse showing:
  
• "Attachment not found", but it's there!
  
• broken error:
  

[just-boris]

Yes, that weird things are caused by some inline styles. I prepared a PR to fix it. #716

For now, you can work around by adding style-src 'self’ 'unsafe-inline'

[georgecrawford]

I see the same problems with script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';.

[georgecrawford]

I downloaded the allure xml files, and it all looks perfect when I run allure generate allure-results/ && allure report open with CLI version 1.4.19. So it's definitely a Jenkins/CSP issue.

[just-boris]

:( Ok, then you can shut down the CSP at all, by setting it to "" (empty string). I will come up with a better solution at the next week.

[georgecrawford]

Yep, it's fine when I do that. I'll keep on trying other combinations too.

[georgecrawford]

Good news: I have it working now with just: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';

[just-boris]

Updated our Jenkins docs. http://wiki.qatools.ru/display/AL/Allure+Jenkins+Plugin
We consider that this setting would be the best solution for the issue.

[just-boris]

thanks @georgecrawford for the report and help!

[SpyderWeiss]

For those of you having issues with this, I had to set BOTH Jenkins and Hudson properties for it to work, just run these in the /script window of your Jenkins server:
System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';")

System.setProperty("jenkins.model.DirectoryBrowserSupport.CSP", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';")

[tonka3000]

thanks @SpyderWeiss , your solutions works 👍

[akiikius]

Hi all, where can i find: /script window of the Jenkins server?

[nickwinn]

@akiikius https:///script OR Manage Jenkins >> Script Console

[dvazar]

When I run Jenkins container, I get an error: Error: Could not find or load main class self
Run command:

docker run --name jenkins -p 8080:8080 -p 50000:50000 --env JAVA_OPTS="-Dhudson.model.DirectoryBrowserSupport.CSP=default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';" --env JAVA_OPTS="-Djenkins.model.DirectoryBrowserSupport.CSP=default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';" jenkins

[just-boris]

@adv-tsk You need to escape property. Currently, expression parsed as following

-Dhudson.model.DirectoryBrowserSupport.CSP=default-src

The rest of expression will be passed as a main class name.

Try this:

docker run --name jenkins -p 8080:8080 -p 50000:50000 \
    --env JAVA_OPTS="-Dhudson.model.DirectoryBrowserSupport.CSP=\"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';\"" jenkins

Note extra \" around propery values.

[dvazar]

Thanks @just-boris, it works!)

[singhverse]

I am still having issues with accessing reports in Chrome.
I did set the properties as per @SpyderWeiss 's comments. That fixed the issue for firefox only! I am a chrome lover and so is my whole team so we need it working on Google Chrome, any suggestions/solutions?

[Cynicus]

+1 to brpIHDUN. This trick not worked in chrome.

[mobidevadmin]

+1 same issue in Chrome

[just-boris]

Hello, guys!

Could you tell more details about the current issue? Maybe we have got some regression here. A screenshot of console with errors would be so helpful there

[mobidevadmin]

Hi just-boris,

Here are Jenkins run parameters

/usr/bin/daemon --name=jenkins --inherit --env=JENKINS_HOME=/var/lib/jenkins --output=/var/log/jenkins/jenkins.log --pidfile=/var/run/jenkins/jenkins.pid -- /usr/bin/java -Djenkins.model.DirectoryBrowserSupport.CSP=default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; -jar /usr/share/jenkins/jenkins.war --webroot=/var/cache/jenkins/war --httpPort=8080
/usr/bin/java -Djenkins.model.DirectoryBrowserSupport.CSP=default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; -jar /usr/share/jenkins/jenkins.war --webroot=/var/cache/jenkins/war --httpPort=8080

Jenkins version 2.31
Allure plugin version 2.10

[mobidevadmin]

Allright,

tried to add these lines in jenkins console via Firefox ( I did it in Chrome previously) - and it worked. So it's either Chrome or one need to add the lines twice in a row in order to make it applied:

System.setProperty("jenkins.model.DirectoryBrowserSupport.CSP", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';")
System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';")

For the very first time i added that links i had an empty "Result", now it answered me with some extra lines.
Sorry for this kind of panic.