1.8.13: page load broken with `'self'` content security policy (Ace2Editor.init() error event while waiting for load event)

[dvzrv]

Describe the bug
After updating from 1.8.12 to 1.8.13 (no plugins, plain packaged version that I provide in the AUR), I get the following on loading any pad:

An error occurred

Please press and hold Ctrl and press F5 to reload this page

If the problem persists, please send this error message to your webmaster:
ErrorId: Hlk02KxskYcOry455748
Unhandled Promise rejection
URL: https://my-pad.tld/p/test
UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:87.0) Gecko/20100101 Firefox/87.0
Ace2Editor.init() error event while waiting for load event
at https://my-pad.tld/javascripts/lib/ep_etherpad-lite/static/js/pad.js?callback=require.define&v=580f7db7 at line 49

Reloading the page doe not fix the issue.

To Reproduce
Steps to reproduce the behavior:

1. Go to any pad
2. See error

Expected behavior
pad loads normally

Screenshots

Server (please complete the following information):

• Etherpad version: 1.8.13
• OS: Arch Linux
• Node.js version (node --version): v15.12.0
• npm version (npm --version): 7.7.4

Desktop (please complete the following information):

• OS: Arch Linux
• Browser: Firefox
• Version: 87.0

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Downgrading to 1.8.12 fixes the issue.

The PKGBUILD that creates the package can be found here: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=etherpad-lite

[webzwo0i]

works for me on ff 87.0/node 15.12.0/npm 7.7.4

Do you see any other errors in developer console when this happens?

[flotho]

same issue with a reverse proxy and authenticatication in the proxy.
without the authentication in the proxy then it's working

[webzwo0i]

Interesting! Would be cool to get this fixed.
Can you provide steps to replicate? Do you mean https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authenticate ?

[flotho]

maybe related to #4820

[flotho]

same issue with a reverse proxy and authenticatication in the proxy.
without the authentication in the proxy then it's working

my bad, failed with or without reverse proxy.

[flotho]

$ node -v
v14.16.1
[etherpad@pad etherpad-lite]$ npm -v
6.14.12

here are the result :

client - i.niceSelect is not a function -- {
  errorId: 'NFBK9QbSxcFYsReiQBpX',
  type: 'Unhandled Promise rejection',
  msg: 'i.niceSelect is not a function',
  url: 'http://10.0.199.7:9001/p/atelierdev-connecteur-odoo',
  source: 'http://10.0.199.7:9001/static/js/require-kernel.js?v=83aad60f line 226 > Function',
  linenumber: 71,
  userAgent: 'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:87.0) Gecko/20100101 Firefox/87.0',
  stack: 'ep_webpack/static/dist/js/index-13b609ac302aec3ed7e9.js/module.exports</</t.postAceInit@http://10.0.199.7:9001/static/js/require-kernel.js?v=83aad60f line 226 > Function:71:18211\n' +
    'callHookFnAsync/<@http://10.0.199.7:9001/javascripts/lib/ep_etherpad-lite/static/js/ace2_common.js?callback=require.define&v=83aad60f:12958:18\n' +
    'callHookFnAsync@http://10.0.199.7:9001/javascripts/lib/ep_etherpad-lite/static/js/ace2_common.js?callback=require.define&v=83aad60f:12921:16\n' +
    'ep_etherpad-lite/static/js/pluginfw/hooks.js/exports.aCallAll/results<@http://10.0.199.7:9001/javascripts/lib/ep_etherpad-lite/static/js/ace2_common.js?callback=require.define&v=83aad60f:13036:54\n' +
    'ep_etherpad-lite/static/js/pluginfw/hooks.js/exports.aCallAll@http://10.0.199.7:9001/javascripts/lib/ep_etherpad-lite/static/js/ace2_common.js?callback=require.define&v=83aad60f:13036:13\n' +
    'postAceInit@http://10.0.199.7:9001/javascripts/lib/ep_etherpad-lite/static/js/pad.js?callback=require.define&v=83aad60f:500:13\n'
}

and same thing with node 16 and npm 7.10

[webzwo0i]

Can you post a list of your installed plugins+version please.

[flotho]

I can, but actually i restarted from a fresh install.
and now everything is running perfectly with either FF or chrome.
Here is the final conf :

Numéro de version: 1.8.13

Dernière version disponible: 1.8.13

Git sha: 5db0c8d
Greffons installés

ep_colibris_full_width
ep_etherpad-lite
ep_disable_chat
ep_font_size
ep_headings2
ep_adminpads2
ep_headerauth
ep_embedded_hyperlinks2
ep_themes
ep_table_of_contents
ep_list_pads
ep_image_upload

Parties installées

ep_image_upload/ep_image_upload
ep_list_pads/ep_list_pads
ep_table_of_contents/ep_table_of_contents
ep_themes/ep_themes
ep_embedded_hyperlinks2/main
ep_headerauth/ep_headerauth
ep_adminpads2/ep_adminpads2
ep_headings2/main
ep_font_size/main
ep_disable_chat/ep_disable_chat
ep_etherpad-lite/openapi
ep_etherpad-lite/adminsettings
ep_etherpad-lite/adminplugins
ep_etherpad-lite/admin
ep_etherpad-lite/tests
ep_etherpad-lite/socketio
ep_etherpad-lite/errorhandling
ep_etherpad-lite/importexport
ep_etherpad-lite/apicalls
ep_etherpad-lite/webaccess
ep_etherpad-lite/padreadonly
ep_etherpad-lite/padurlsanitize
ep_etherpad-lite/specialpages
ep_etherpad-lite/i18n
ep_etherpad-lite/stats
ep_etherpad-lite/static
ep_etherpad-lite/express
ep_etherpad-lite/Minify
ep_etherpad-lite/DB
ep_colibris_full_width/ep_colibris_full_width

Crochets installés
Crochets côté serveur

authenticate:

ep_headerauth:

    ep_headerauth:
        ep_headerauth 

ccRegisterBlockElements:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

clientVars:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/index 

ep_themes:

    ep_themes:
        ep_themes/index:clientVars 

collectContentImage:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

collectContentPost:

ep_headings2:

    main:
        ep_headings2/static/js/shared 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

collectContentPre:

ep_font_size:

    main:
        ep_font_size/static/js/shared 

ep_headings2:

    main:
        ep_headings2/static/js/shared 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

createServer:

ep_etherpad-lite:

    express:
        ep_etherpad-lite/node/hooks/express 

eejsBlock_adminMenu:

ep_adminpads2:

    ep_adminpads2:
        ep_adminpads2 

eejsBlock_body:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/index 

eejsBlock_dd_format:

ep_font_size:

    main:
        ep_font_size/index 

eejsBlock_dd_view:

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/index 

eejsBlock_editbarMenuLeft:

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/index 

ep_font_size:

    main:
        ep_font_size/index 

ep_headings2:

    main:
        ep_headings2/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/editbar 

eejsBlock_editorContainerBox:

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/index 

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/index 

eejsBlock_indexWrapper:

ep_list_pads:

    ep_list_pads:
        ep_list_pads/index 

eejsBlock_mySettings:

ep_colibris_full_width:

    ep_colibris_full_width:
        ep_colibris_full_width/pad 

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/index 

eejsBlock_mySettings.dropdowns:

ep_themes:

    ep_themes:
        ep_themes/index:eejsBlock_mySettings_dropdowns 

eejsBlock_scripts:

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/index 

ep_themes:

    ep_themes:
        ep_themes/index:eejsBlock_scripts 

eejsBlock_styles:

ep_disable_chat:

    ep_disable_chat:
        ep_disable_chat/disable_chat:eejsBlock_styles 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/index 

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/index 

exportHtmlAdditionalTagsWithData:

ep_font_size:

    main:
        ep_font_size/exportHTML 

expressCloseServer:

ep_etherpad-lite:

    socketio:
        ep_etherpad-lite/node/hooks/express/socketio 

expressConfigure:

ep_etherpad-lite:

    webaccess:
        ep_etherpad-lite/node/hooks/express/webaccess 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/index 

expressCreateServer:

ep_adminpads2:

    ep_adminpads2:
        ep_adminpads2 

ep_etherpad-lite:

    admin:
        ep_etherpad-lite/node/hooks/express/admin
    adminplugins:
        ep_etherpad-lite/node/hooks/express/adminplugins
    adminsettings:
        ep_etherpad-lite/node/hooks/express/adminsettings
    apicalls:
        ep_etherpad-lite/node/hooks/express/apicalls
    errorhandling:
        ep_etherpad-lite/node/hooks/express/errorhandling
    i18n:
        ep_etherpad-lite/node/hooks/i18n
    importexport:
        ep_etherpad-lite/node/hooks/express/importexport
    openapi:
        ep_etherpad-lite/node/hooks/express/openapi
    padreadonly:
        ep_etherpad-lite/node/hooks/express/padreadonly
    padurlsanitize:
        ep_etherpad-lite/node/hooks/express/padurlsanitize
    socketio:
        ep_etherpad-lite/node/hooks/express/socketio
    specialpages:
        ep_etherpad-lite/node/hooks/express/specialpages
    static:
        ep_etherpad-lite/node/hooks/express/static
    tests:
        ep_etherpad-lite/node/hooks/express/tests 

ep_list_pads:

    ep_list_pads:
        ep_list_pads/index:registerRoute 

getLineHTMLForExport:

ep_font_size:

    main:
        ep_font_size/exportHTML 

ep_headings2:

    main:
        ep_headings2/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/exportHTML 

handleMessage:

ep_headerauth:

    ep_headerauth:
        ep_headerauth 

loadSettings:

ep_headerauth:

    ep_headerauth:
        ep_headerauth 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/settings 

padCreate:

ep_adminpads2:

    ep_adminpads2:
        ep_adminpads2 

padInitToolbar:

ep_font_size:

    main:
        ep_font_size/index 

padRemove:

ep_adminpads2:

    ep_adminpads2:
        ep_adminpads2 

restartServer:

ep_etherpad-lite:

    express:
        ep_etherpad-lite/node/hooks/express 

shutdown:

ep_etherpad-lite:

    DB:
        ep_etherpad-lite/node/db/DB
    express:
        ep_etherpad-lite/node/hooks/express
    Minify:
        ep_etherpad-lite/node/utils/Minify
    stats:
        ep_etherpad-lite/node/stats 

socketio:

ep_adminpads2:

    ep_adminpads2:
        ep_adminpads2 

ep_etherpad-lite:

    adminplugins:
        ep_etherpad-lite/node/hooks/express/adminplugins
    adminsettings:
        ep_etherpad-lite/node/hooks/express/adminsettings
    socketio:
        ep_etherpad-lite/node/handler/PadMessageHandler 

stylesForExport:

ep_font_size:

    main:
        ep_font_size/exportHTML 

ep_headings2:

    main:
        ep_headings2/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/exportHTML 

Crochets côté client

aceAttribsToClasses:

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/static/js/index 

ep_font_size:

    main:
        ep_font_size/static/js/index 

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/clientHooks 

aceCreateDomLine:

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/static/js/index 

ep_font_size:

    main:
        ep_font_size/static/js/index 

aceDomLineProcessLineAttributes:

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/clientHooks 

aceEditEvent:

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/static/js/aceEditEvent:aceEditEvent 

aceEditorCSS:

ep_colibris_full_width:

    ep_colibris_full_width:
        ep_colibris_full_width/static/js/colibris_full_width 

ep_font_size:

    main:
        ep_font_size/static/js/index 

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/clientHooks 

aceInitialized:

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/static/js/index 

ep_font_size:

    main:
        ep_font_size/static/js/index 

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/clientHooks 

ep_themes:

    ep_themes:
        ep_themes/static/js/init 

aceRegisterBlockElements:

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/clientHooks 

ccRegisterBlockElements:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

collectContentImage:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

collectContentPost:

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

collectContentPre:

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/static/js/index 

ep_font_size:

    main:
        ep_font_size/static/js/shared 

ep_headings2:

    main:
        ep_headings2/static/js/shared 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/contentCollection 

handleClientMessage_ACCEPT_COMMIT:

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/static/js/aceEditEvent:aceEditEvent 

handleClientMessage_NEW_CHANGES:

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/static/js/aceEditEvent:aceEditEvent 

postAceInit:

ep_colibris_full_width:

    ep_colibris_full_width:
        ep_colibris_full_width/static/js/colibris_full_width 

ep_embedded_hyperlinks2:

    main:
        ep_embedded_hyperlinks2/static/js/index 

ep_font_size:

    main:
        ep_font_size/static/js/index 

ep_headings2:

    main:
        ep_headings2/static/js/index 

ep_table_of_contents:

    ep_table_of_contents:
        ep_table_of_contents/static/js/postAceInit:postAceInit 

postToolbarInit:

ep_font_size:

    main:
        ep_font_size/static/js/index 

ep_image_upload:

    ep_image_upload:
        ep_image_upload/static/js/toolbar 

It works behind an apache RP with authentication through apereo CAS.

"requireAuthentication": true,
"trustProxy": true,
"headerauth": {
"username_header": "x-authenticated-user",
"displayname_header": "x-authenticated-name"
},

hope it can help.

I still have something that bothering me.
When I'm looged in ssh with the etherpad user, the npm version is 7.10 but in the logs, it use the 6.4.x release.
Any idea where it could come from?

Regards

[larskasper]

Could it be that the server (a proxy server like nginx) is setting a Content-Security-Policy header (CSP)?

That can be checked in the server configuration, or in a web browser’s inspector/developer tools (in Firefox for example: Tools → Web Developer → Web Console, then expanding the GET requests and looking for Response Headers; in that console you also see the errors if something is blocked by CSP), or in a tool like curl (curl -isS https://pad.example/p/test | grep -i content-security-policy).

I noticed the mentioned error message and non-working pads with Etherpad Lite version 1.8.13 when in the proxying nginx a Content-Security-Policy was set. The error was gone when the Content-Security-Policy was not set (or a permissive one like add_header Content-Security-Policy "default-src https: 'unsafe-eval' 'unsafe-inline'"; was set, which still blocks some content), or when Etherpad Lite version 1.8.12 was used (with a Content-Security-Policy).

[nuxi]

I just upgraded etherpad from 1.8.6 to 1.8.13 and hit this issue.

Previously something like this worked just fine default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' data:; connect-src 'self'; img-src 'self' https: data:; media-src 'self' https:; frame-src 'self'; frame-ancestors 'self'; form-action 'self'

Now 'self' no longer seems to match requests eventhough they are going to the same host, with the same port, and the same scheme. To get it working again I had to explicitly add the host to default-src, script-src, style-src, and connect-src. This shouldn't be necessary, 'self' should have covered this case. I don't know why it suddenly isn't after an upgrade.

[nuxi]

I was able to bisect it, 'self' worked in the CSP up until 40448606

[rhansen]

Do all browsers behave the same? This looks like a browser bug to me (see MDN), but I don't know enough about CSP to be sure.

[nuxi]

I see the problem in Firefox 89 and I do not see it in Chromium 90.

I'm just running 1.8.12 instead for now.

[webzwo0i]

Not a browser bug, but non-perfect spec, see w3c/webappsec-csp#459 and https://bugzilla.mozilla.org/show_bug.cgi?id=1567970

:-(