console
console copied to clipboard
openshift
CONSOLE-4266: Fix CSP inline script tag error in Console HTML template
This PR addresses a CSP violation due to Console HTML index template containing an inline <script> tag.
By default, CSP standard treats inline <script> tags as unsafe.
This particular <script> tag is part of the Console application, so we allow it within our policy via the nonce attribute.
A cryptographic nonce (number used once) to allow scripts in a script-src Content-Security-Policy. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.
This PR also does a bit of refactoring around crypto/rand related functions, removing code duplication.
Basic verification steps
git cloneConsole repo, switch to latestmasterbranch, build Console backend and frontend,oc loginto cluster and run the Bridge server (enabling dynamic demo plugin is not necessary). Visithttp://localhost:9000/in your browser, the above CSP error :point_up: should appear in browser dev tools "Console" tab.- Apply changes from this PR, rebuild Console backend (rebuilding frontend is not necessary) and rerun the Bridge server. Open Console in your web browser, the CSP error as mentioned above should not appear.
CSP standard compliance verification steps
- Inspect HTML and check the presence of
nonceattribute on the inline<script>tag.
- Inspect network activity and check the presence of
'nonce-{value}'within the CSP response header.
- Reload the page and repeat steps 1. and 2. above. The value of
nonceshould always be different.
cc @jhadvig @spadgett
@vojtechszocs: This pull request references CONSOLE-4266 which is a valid jira issue.
Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.
In response to this:
WIP needs testing
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.
@vojtechszocs: This pull request references CONSOLE-4266 which is a valid jira issue.
Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.
In response to this:
This PR addresses a CSP violation due to Console HTML index template containing an inline
<script>tag.
By default, CSP standard treats inline
<script>tags as unsafe.This particular
<script>tag is part of the Console application, so we allow it within our policy via the nonce attribute.A cryptographic nonce (number used once) to allow scripts in a script-src Content-Security-Policy. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.
This PR also does a bit of refactoring around
crypto/randrelated functions, removing code duplication.Basic verification steps
git cloneConsole repo, switch to latestmasterbranch, build Console backend and frontend,oc loginto cluster and run the Bridge server (enabling dynamic demo plugin is not necessary). Visithttp://localhost:9000/in your browser, the above CSP error :point_up: should appear in browser dev tools "Console" tab.- Apply changes from this PR, rebuild Console backend (rebuilding frontend is not necessary) and rerun the Bridge server. Open Console in your web browser, the CSP error as mentioned above should not appear.
CSP standard compliance verification steps
- Inspect HTML and check the presence of
nonceattribute on the inline<script>tag.
- Inspect network activity and check the presence of
'nonce-{value}'within the CSP response header.
- Reload the page and repeat steps 1. and 2. above. The value of
nonceshould always be different.cc @jhadvig @spadgett
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.
@vojtechszocs: This pull request references CONSOLE-4266 which is a valid jira issue.
Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.
In response to this:
This PR addresses a CSP violation due to Console HTML index template containing an inline
<script>tag.
By default, CSP standard treats inline
<script>tags as unsafe.This particular
<script>tag is part of the Console application, so we allow it within our policy via the nonce attribute.A cryptographic nonce (number used once) to allow scripts in a script-src Content-Security-Policy. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.
This PR also does a bit of refactoring around
crypto/randrelated functions, removing code duplication.1. Basic verification steps
git cloneConsole repo, switch to latestmasterbranch, build Console backend and frontend,oc loginto cluster and run the Bridge server (enabling dynamic demo plugin is not necessary). Visithttp://localhost:9000/in your browser, the above CSP error :point_up: should appear in browser dev tools "Console" tab.- Apply changes from this PR, rebuild Console backend (rebuilding frontend is not necessary) and rerun the Bridge server. Open Console in your web browser, the CSP error as mentioned above should not appear.
2. CSP standard compliance verification steps
- Inspect HTML and check the presence of
nonceattribute on the inline<script>tag.
- Inspect network activity and check the presence of
'nonce-{value}'within the CSP response header.
- Reload the page and repeat steps 1. and 2. above. The
noncevalue should be different upon each reload.cc @jhadvig @spadgett
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: jhadvig, TheRealJon, vojtechszocs
The full list of commands accepted by this bot can be found here.
The pull request process is described here
- ~~frontend/OWNERS~~ [TheRealJon,jhadvig,vojtechszocs]
- ~~pkg/OWNERS~~ [TheRealJon,jhadvig]
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
![openshift-ci[bot] avatar](https://avatars.githubusercontent.com/in/91280?v=4 "Published by a pub.dev verified publisher"){kind=small}
QE Approver: /assign @yapei Docs Approver: /assign @opayne1 PX Approver: /assign @reestr
@vojtechszocs: This pull request references CONSOLE-4266 which is a valid jira issue.
Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.
In response to this:
This PR addresses a CSP violation due to Console HTML index template containing an inline
<script>tag.
By default, CSP standard treats inline
<script>tags as unsafe.This particular
<script>tag is part of the Console application, so we allow it within our policy via the nonce attribute.A cryptographic nonce (number used once) to allow scripts in a script-src Content-Security-Policy. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.
This PR also does a bit of refactoring around
crypto/randrelated functions, removing code duplication.1. Basic verification steps
git cloneConsole repo, switch to latestmasterbranch, build Console backend and frontend,oc loginto cluster and run the Bridge server (enabling dynamic demo plugin is not necessary). Visithttp://localhost:9000/in your browser, the above CSP error :point_up: should appear in browser dev tools "Console" tab.- Apply changes from this PR, rebuild Console backend (rebuilding frontend is not necessary) and rerun the Bridge server. Open Console in your web browser, the CSP error as mentioned above should not appear.
2. CSP standard compliance verification steps
- Inspect HTML and check the presence of
nonceattribute on the inline<script>tag.
- Inspect network activity and check the presence of
'nonce-{value}'within the CSP response header.
- Reload the page and repeat steps 1. and 2. above. The
noncevalue should be different upon each reload.cc @jhadvig @spadgett
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.
/retest-required
Remaining retests: 0 against base HEAD 4ca6d0a8089438218b56abf6dad816cf4f039e56 and 2 for PR HEAD 32a3676c3a651d0c0c047480a2a45c659900a227 in total
@vojtechszocs: all tests passed!
Full PR test history. Your PR dashboard.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.
[ART PR BUILD NOTIFIER]
Distgit: openshift-enterprise-console This PR has been included in build openshift-enterprise-console-container-v4.19.0-202411130808.p0.g78307da.assembly.stream.el9. All builds following this will include this PR.
