1370952 - Reftest analyzer fails to load testcase

Status: VERIFIED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Botond Ballo [:botond]]

STR:
  Load [1]

  (Alternatively, visit the Try push at [2], select the first "Ru6"
  failure under "Windows 7 opt", and click the "Launch the Reftest
  Analyzer in a new window" button.)

Expected results:

  The Reftest Analyzer renders the testcase.

Actual results:

  The Reftest Analyzer is stuck on "Loading log...".
  The devtools console shows "TypeError: item is undefined"
  coming from [3].

[1] https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/Msp_2YtORRa8R_atWKXoSA/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1
[2] https://treeherder.mozilla.org/#/jobs?repo=try&revision=0f79dc5500e101058f953985b87e3de4dfd5222d
[3] https://hg.mozilla.org/mozilla-central/file/tip/layout/tools/reftest/reftest-analyzer.xhtml#l252

Comment 1

[Bobby Holley (:bholley)]

Just hit this on [1]. Joel, can you resource a fix? The reftest analyzer is a useful tool, especially for intermittents.

[1] https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=927dfa701c4057bab166448ff29d673c266bb0da&selectedJob=160731110

Comment 2

[Joel Maher ( :jmaher ) (UTC -8)]

this seems odd, links that used to work are failing now.  When I load any reftest analyzer I get an error in the console:
Content Security Policy: The page’s settings blocked the loading of a resource at https://taskcluster-artifacts.net/DVPBXaoZQme4PzujlH2QkQ/0/public/logs/live_backing.log (“connect-src”).


so either something changed on where we store the artifacts, or https://hg.mozilla.org/mozilla-central has recent changes- I assume sometime in the last week this changed.

:gps- would you know why this might be failing?

Comment 3

[(not currently active) Ted Mielczarek]

It looks like hg.mo has a CSP now:
$ curl -LI https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml
HTTP/1.1 200 Script output follows
Server: Apache
Content-Type: application/xhtml+xml
Content-Security-Policy: default-src 'none'; connect-src 'self' https://archive.mozilla.org/ https://public-artifacts.taskcluster.net/ https://queue.taskcluster.net/; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; upgrade-insecure-requests; frame-ancestors https:
Strict-Transport-Security: max-age=31536000
Date: Tue, 27 Feb 2018 18:58:01 GMT
Access-Control-Allow-Origin: *
Content-Disposition: inline; filename="reftest-analyzer.xhtml"
Connection: Keep-Alive
Content-Length: 25303


This is probably necessary to keep hg.mo from being an attack vector. We could presumably host reftest-analyzer on an actual static webhost.

Comment 4

[Joel Maher ( :jmaher ) (UTC -8)]

could we add https://taskcluster-artifacts.net to the connect-src line?  I am not sure who controls hg.m.o

Otherwise, we will need to find a way to host this- maybe as part of treeherder.  Since I see so many other related domains in the connect-src, I would like to pursue adding one more.

Comment 5

[Gregory Szorc [:gps]]

We have a global CSP setting on hg.mo for security reasons. There's an exception for reftest analyzer. The custom CSP header is baked into the hg.mo server configs. So we need to update the hg.mo server config.

Comment 6

[Gregory Szorc [:gps]]

Attachment: ansible/hg-web: add https://taskcluster-artifacts.net/ to CSP policy (bug 1370952);

This is the CloudFront hostname for TaskCluster public artifacts and
replaces https://public-artifacts.taskcluster.net/ (the latter
redirects now).

Review commit: https://reviewboard.mozilla.org/r/223582/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/223582/

Comment 7

[Kendall Libby [:fubar] (he/him)]

Comment on attachment 8954525 [details]
ansible/hg-web: add https://taskcluster-artifacts.net/ to CSP policy (bug 1370952);

https://reviewboard.mozilla.org/r/223582/#review229880

Comment 8

[Ed Morley [:emorley]]

(In reply to Joel Maher ( :jmaher) (UTC-5) from comment #4)
> Otherwise, we will need to find a way to host this- maybe as part of treeherder.

For prior discussion on this see bug 1200501 (in particular bug 1200501 comment 23).

Comment 9

[Connor Sheehan [:sheehan]]

Comment on attachment 8954525 [details]
ansible/hg-web: add https://taskcluster-artifacts.net/ to CSP policy (bug 1370952);

https://reviewboard.mozilla.org/r/223582/#review230790

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/92c5b13c3b88
ansible/hg-web: add https://taskcluster-artifacts.net/ to CSP policy ; r=fubar,sheehan

Comment 11

[Kartikaya Gupta (email:[e-mail])]

Has this been deployed? Clicking on the reftest analyzer button on reftest failures in treeherder still doesn't work.

Comment 12

[Gregory Szorc [:gps]]

It wasn't deployed until a few hours ago. And I had to bounce the server processes for the change to take effect. The change should now be live.

Sorry for the delay. Connor and I were both at the Mercurial developer meetup this weekend and were pretty much out of touch since Thursday.

Comment 13

[Daniel Holbert [:dholbert]]

I confirmed that this works for me now. Marking as "Verified".