Customize CSP for HTML preview

[rocec]

Why the new feature should be added

As a user, I would like to add additional trusted sources to the CSP (Consent Security Policy). This would allow previewing pages with embedded content, e.g. from intranet sites in a corporate environment.

How the new feature should work

Add an option "Additional CSP frame sources" to the plugin settings. Its value shall be added to the CSP used by the HTML preview.

[ahus1]

Thank you for suggesting this. This might pose a security or privacy risk, and might trick users into doing things with unintended consequences. Therefore I'm sceptical.

Please provide a more detailed example (possibly with code) showing which content can't be included.

[ahus1]

Might be related: #1508

[rocec]

My use case is embedding Structurizr diagrams to provide a live view with interactive exploration. This is done using iframes; see Embedding diagrams in the Structurizr docs.

An example in AsciiDoc:

= Embed Structurizr

++++
<iframe id="myEmbeddedDiagram" src="https://structurizr.com/embed/36141?diagram=SystemContext&amp;diagramSelector=false&amp;iframe=myEmbeddedDiagram" width="602px" marginwidth="0" marginheight="0" frameborder="0" scrolling="no" allowfullscreen="true" height="424px"></iframe>
<script type="text/javascript" src="https://static.structurizr.com/js/structurizr-embed.js"></script>
++++

In the IntelliJ JCEF preview, I see the following error in the dev console:

Refused to frame 'https://structurizr.com/' because it violates the following Content Security Policy directive: "frame-src 'self' https://player.vimeo.com/ https://www.youtube.com/".

As a workaround, instead of viewing it directly in the IntelliJ preview, I can convert my file to HTML and open it in a browser.

[ahus1]

Thank you for this example. The next version of the plugin adds https://structurizr.com/ to the list of allowed domains to show content in an iframe. I'll update this issue once a pre-release is available.

[ahus1]

The release 0.41.11 which includes this change will be available in the JetBrains marketplace later today.

[rocec]

Allowing https://structurizr.com/ does not help if you have a custom on-prem installation of Structurizr, e.g. in a corporate network.

I think a configurable allow list is desirable.

Of course, as you said, this may pose a security or privacy risk if used incorrectly. Plus, this feature suggestion issue is just a nice-to-have from my point of view, as it is presumably seldom needed, and there is a workaround (open HTML in external browser).

[rocec]

In any case, thank you very much, not only in this context, but in general for the great work and the continuous support of the entire plugin!