1333929 - Reftest analyzer fails to load with new Content Security Policy header

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Neerja Pancholi[:neerja]]

Treeherder link:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=3bdc7fb45628307448cda428bf984105baa60c12&selectedJob=71363018

Output from Chrome's developer console:
Failed to load resource: the server responded with a status of 404 (Not Found)

Refused to connect to 'https://public-artifacts.taskcluster.net/KQYN-Sa9TBmXR3m8GaXXwg/0/public/logs/live_backing.log' because it violates the following Content Security Policy directive: "connect-src 'self' https://bugzilla.mozilla.org/ https://archive.mozilla.org/ https://queue.taskcluster.net/".

Comment 1

[Neerja Pancholi[:neerja]]

Here is the direct link to reftest analyzer that used to work but is now failing:
https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/KQYN-Sa9TBmXR3m8GaXXwg/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

Steps to reproduce is just to click this link above. 

edmorley seem to be referencing the same issue here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1319172#c38

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/47639c94de37
ansible/hg-web: add public-artifacts.taskcluster.net to CSP connect-src

Comment 3

[Gregory Szorc [:gps]]

This will be deployed in ~20 minutes.

Comment 4

[Gregory Szorc [:gps]]

This is deployed but the reftest analyzer is still failing. This time it complains about image-src and data:. I could chase this rabbit hole all day. Or I could just wait for bug 1200501, which I'm inclined to do.

Comment 5

[Ed Morley [:emorley]]

Ah the new errors only appear after clicking the filename on the left.

Content Security Policy: The page's settings blocked the loading of a resource at data:image/png;base64,iVBORw0KGgoAAAANSU... ("img-src https://hg.mozilla.org").

Bug 1200501 is not going to be fixed overly soon, since we'll need security review (or adding a CSP header) before adding this to Treeherder, due to the risk of XSS revealing Treeherder credentials (or worse, the taskcluster tokens stored in localstorage).

Comment 6

[Gregory Szorc [:gps]]

Attachment: ansible/hg-web: define liberal CSP policy for reftest analyzer (bug 1333929);

Reftest analyzer loads images from "data:" URIs. Yuck. Until bug 1200501
is in place, we have to host the reftest analyzer on hg.mo.

This commit refactors the httpd code to define a separate, more
liberal CSP policy for the reftest analyzer from the rest of the site.

As part of this, the default CSP policy became more secure by dropping
some connect-src items!

There are multiple repositories with copies of the reftest analyzer.
However, an audit of the HTTP logs revealed 99+% of them hit the copy
in mozilla-central. So the URL check only looks for this instance.

The httpd config is a bit ugly. As the inline comments explain, this is
necessary because things like nested <If> and <Location> inside <If>
don't work.

Since the config code is now non-trivial and security is important,
I added a test for the CSP header.

Review commit: https://reviewboard.mozilla.org/r/107334/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/107334/

Comment 7

[Kendall Libby [:fubar] (he/him)]

Comment on attachment 8830586 [details]
ansible/hg-web: define liberal CSP policy for reftest analyzer (bug 1333929);

https://reviewboard.mozilla.org/r/107334/#review108754

I started to suggest using an <if ... && ... > block and then realized you were moving away from that. I feel like there's a better way to do this, but it looks like it will DTRT and I'm happy to let it go for expediency.

Comment 8

[Gregory Szorc [:gps]]

Comment on attachment 8830586 [details]
ansible/hg-web: define liberal CSP policy for reftest analyzer (bug 1333929);

https://reviewboard.mozilla.org/r/107334/#review108754

I could have done it with an `<if X && Y>` block where `X` is the user-agent/query string detection and `Y` is the URL. However, the expression would have been long and redundant. I felt this was uglier.

I would love to find a cleaner way to write this. But every iteration I tried failed :/

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/a32e19f15756
ansible/hg-web: define liberal CSP policy for reftest analyzer ; r=fubar

Comment 10

[Gregory Szorc [:gps]]

This is deployed. reftest analyzer appears to be working.