1303086 - resource://devtools/client/jsonview/blocked by site's base-uri CSP directive (on dev-edition)

Status: RESOLVED DUPLICATE of bug 1316393

(DevTools :: JSON Viewer, defect, P2)

Description

[Andrew Williamson [:eviljeff]]

If a site's CSP rules disallow external scripts then any JSON response from that site is broken because the devtools jsonview inserts the response headers as extra content on the end (making it invalid JSON); then tries to insert a script to handle it which is blocked by the CSP

e.g. https://addons.allizom.org/blocked/blocklists.json

results in this CSP error:
Content Security Policy: The page’s settings blocked the loading of a resource at resource://devtools/client/jsonview/ (“base-uri https://addons.allizom.org https://addons.mozilla.org https://addons.allizom.org”).

AMO generates it's CSP rules here: https://github.com/mozilla/addons-server/blob/master/src/olympia/lib/settings_base.py

Comment 1

[Andrew Williamson [:eviljeff]]

https://github.com/mozilla/addons-server/blob/master/src/olympia/lib/settings_base.py#L1259 onwards, more precisely.

Comment 2

[[e-mail]]

In this specific case "resource://devtools/client/jsonview/" appears to be being blocked by the base-uri directive.

The expected outcome would be that devtools should not be impacted by a site's CSP configuration.

Comment 4

[Oriol Brufau [:Oriol]]

The link in comment 0 is broken, but this should have been fixed in bug 1316393.