Web: cannot open images in selfhost anymore

[bpasero]

Selfhosting web, I cannot see images anymore when opened (e.g. from vscode-docs):

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-1575547817862'". Either the 'unsafe-inline' keyword, a hash ('sha256-wYGzaCFwj3TvTS34soRrdUzuFXoP41wOXBmVV2zSHds='), or a nonce ('nonce-...') is required to enable inline execution.

[mjbvz]

I just tested this using ./resources/server/web.sh but could not repo:

What OS and browser was this for?

[bpasero]

@mjbvz make sure to try from our web selfhost setup, not out of sources.

[mjbvz]

I can repo on edge only. The error seems to be that edge is blocking something. Here is the content of the iframe:

I don't know why this is being blocked or why the blocking error isn't being displayed properly

[mjbvz]

Also now effecting VSO so I need to figure out what is going on

[mjbvz]

After a lot of trial and error, I finally discovered a one line change that fixes this: rewrite the content security policy of the webview content.

Here's the fix applied to the markdown preview for example:

diff --git a/extensions/markdown-language-features/src/features/previewContentProvider.ts b/extensions/markdown-language-features/src/features/previewContentProvider.ts
index 0be66d1d63..30048dc58f 100644
--- a/extensions/markdown-language-features/src/features/previewContentProvider.ts
+++ b/extensions/markdown-language-features/src/features/previewContentProvider.ts
@@ -213,7 +213,7 @@ export class MarkdownContentProvider {
 
                        case MarkdownPreviewSecurityLevel.Strict:
                        default:
-                               return `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' ${rule} https: data:; media-src 'self' ${rule} https: data:; script-src 'nonce-${nonce}'; style-src 'self' ${rule} 'unsafe-inline' https: data:; font-src 'self' ${rule} https: data:;">`;
+                               return `<meta http-equiv="Content-Security-Policy" content="default-src *; img-src 'self' ${rule} https: data:; media-src 'self' ${rule} https: data:; script-src 'nonce-${nonce}'; style-src 'self' ${rule} 'unsafe-inline' https: data:; font-src 'self' ${rule} https: data:;">`;
                }
        }
 }

This fix makes no sense. There is nothing that the inner document (the html that comes from extensions) should be able to set or do that effects whether or not our webview iframes can be loaded.

I've been trying all afternoon to put together a minimal repo to file this against Chromium but so far have not been able to. It also only effects chromium nightly at the moment. @bpasero and @kieferrm Can we please also loop in some folks from the edge team on this?

[bpasero]

/cc @jungkees

[mjbvz]

ping @jungkees Haven't been able to make much progress with this one. Any advice on who to reach out to on edge for help?

[jungkees]

Sorry about the delay. I'll find out who to talk to in our team.