[CSP] violation in about:addons page at add-ons screenshots preview

[ValentinaPC]

Relates to #1660

Steps to reproduce:

1. Load about:addons page
2. Access details page for an add-on with screenshots
3. Click to preview the screenshots

Expected results:
There is no CSP violation in the console.

Actual results:
There is a CSP violation displayed in the console.

Notes/Issues:
Please see the csp reporting via network: https://pastebin.mozilla.org/8858326
Verified on FF44(Win 7). Issue is reproducing on AMO-prod.
Screenshot for this issue:

Also, when refreshing about:addons page or an add-on details page there is an other csp violation (https://pastebin.mozilla.org/8858333)
Please see the screenshot: this is a duplicate of #2454

[andymckay]

Blocks #1660

[muffinresearch]

This one is fixable with config, but it shouldn't be happening. I think this might be a bug with some kind of image pre-loading via new Image() but it needs further investigation to pin it down.

[muffinresearch]

Fwiw the latter bug is a dupe of #2454

[muffinresearch]

Ok this is the line causing the problem: https://github.com/mozilla/olympia/blob/master/static/js/lib/jquery-ui/ui.lightbox.js#L126 the cause is a empty src attribute for the close button image. This then matches the base-uri which has been set to https://addons.mozilla.org.

[muffinresearch]

This should be testable on -dev and stage with the following disco pane hosts:

dev: https://addons-dev-services.allizom.org/
stage: https://addons-services.allizom.org/

[ValentinaPC]

It seems that with the provided hosts, the banner is not working in disco pane (neither in stage or dev)
This is what we use, that works:
dev: https://addons-dev.allizom.org/
stage: https://addons.allizom.org/

[muffinresearch]

The fix isn't on stage yet.

-dev is actively blocking connect-src due to configuration issues as the services host is not setup quite the same as production. I'm hoping we can change the settings to match up with production rather than paper over the problem with additional CSP config.

See https://github.com/mozilla/olympia/issues/1555#issuecomment-179559960 and my replies.

[ValentinaPC]

Verified as fixed on AMO-dev FF45(Win 7).
Postfix screenshot: