visualizing report in Jenkins

[andreav]

Hello,
I'm trying to visualize the report in Jenkins, but I got these errors:

Refused to load the stylesheet 'https://unpkg.com/purecss@2.0.3/build/pure-min.css' because it violates the following Content Security Policy directive: "style-src 'self'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.

k6-test.results.html:7 Refused to load the stylesheet 'https://use.fontawesome.com/releases/v5.15.1/css/all.css' because it violates the following Content Security Policy directive: "style-src 'self'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.

k6-test.results.html:9 Refused to load the image 'https://raw.githubusercontent.com/benc-uk/k6-reporter/main/assets/icon.png' because it violates the following Content Security Policy directive: "img-src 'self'".

k6-test.results.html:13 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-yu/Yl9DuKHjUxEBa9OcQyl+0cHmw0UuHs9XVohodlIw='), or a nonce ('nonce-...') is required to enable inline execution.

k6-test.results.html:140 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-CA/eh4+2R0J7cEQ14gBMtx834RIOjzMUqCM+evtrkp4='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

k6-test.results.html:482 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-IOWYPccv4+GIAWz50PQ4hgBzwty+G8ckj9XrN5jdx6g='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

If I disable CSP in Jenkins it is correctly visualized.

Default jenkins CSP is: sandbox; default-src 'none'; img-src 'self'; style-src 'self';

Do you know a workaround less aggressive / more secure?

Thank you for this very useful utility!

[andreav]

By the way, I got it visualized correctly using this less permissive CSP (still not secure I think..)

"sandbox; default-src 'none'; img-src 'self' raw.githubusercontent.com/benc-uk/k6-reporter/main/assets/icon.png; style-src 'self' use.fontawesome.com unpkg.com 'unsafe-inline'; font-src use.fontawesome.com";