1426765 - JS script from Github enterprise blocked by SRI

Status: RESOLVED INVALID

(Core :: DOM: Security, enhancement)

Description

[François Marier [:francois]]

We've received a report that some of the JS resources in Github enterprise get blocked by SRI in Firefox, but not in Chrome:

  https://github.com/webcompat/web-bugs/issues/14307

Comment 1

[François Marier [:francois]]

Attachment: frameworks-9be27f368479f4cadaa2dbf4642c7989afac396d6c61ec3ec4112aa0ad2494ab.js

Here is the script element from the page HTML:

    <script crossorigin="anonymous" integrity="sha256-m+J/NoR59Mraotv0ZCx5ia+sOW1sYew+xBEqoK0klKs=" src="https://assets.github.factset.com/assets/frameworks-9be27f368479f4cadaa2dbf4642c7989afac396d6c61ec3ec4112aa0ad2494ab.js"></script>

along with the JS file which does hash to the value in the HTML:

    $ openssl dgst -sha256 -binary frameworks-9be27f368479f4cadaa2dbf4642c7989afac396d6c61ec3ec4112aa0ad2494ab.js | openssl base64 -A
    m+J/NoR59Mraotv0ZCx5ia+sOW1sYew+xBEqoK0klKs=

Comment 2

[Daniel Veditz [:dveditz]]

Freddy: since Francois is still on PTO, any idea what could be going on here?

Comment 3

[Frederik Braun [:freddy]]

It seems to me that the bug isn't about the file but much rather about how the file is delivered to Firefox. I know we had problems with various transport encodings, in the past.
Maybe there are other encodings that are used less widely which will  trigger similar problems?

I'd have to get access to a GitHub enterprise instance to nail this down.
SRI debug logs and a decrypted traffic dump would help as well.

Instructions on how to get SRI debug logs below:

How to test:
1) run Firefox with an environment variable MOZ_LOG="SRI:4" 
2) collect log output from stdout and attach to this bug

Comment 4

[Patrick Toomey]

Some things that might help debug this:

* What version of GitHub Enterprise is this?
* Try perform the SHA256 calculation using the file downloaded using Firefox (rather than wget).
* When you download the file using Firefox, provide the full request/response headers (minus any sensitive cookies)

I quickly did a search and do not see this reported more broadly internally. But, I will look in a few more spots later today.

Comment 5

[Patrick Toomey]

I downloaded Firefox 58.0b15 for Mac and I was able to access a copy of GitHub Enterprise 2.12.1 with no problems.

Comment 6

[me_theonlyone]

Answers:

* What version of GitHub Enterprise is this?
A: This is github enterprise 2.11

I checked the network tab while loading the github.factset.com and searched for any .css
the request headers are as follows
Accept	text/css,*/*;q=0.1
Accept-Encoding	gzip, deflate, br
Accept-Language	en-US,en;q=0.5
Cache-Control	no-cache
Connection	keep-alive
DNT	1
Host	assets.github.factset.com
Origin	https://github.factset.com
Pragma	no-cache
Referer	https://github.factset.com/
User-Agent	Mozilla/5.0 (Windows NT 6.1; W…) Gecko/20100101 Firefox/58.0

But response is none.
All i see is a security error: 

assets.github.factset.com uses an invalid security certificate.The certificate is not trusted because the issuer certificate is unknown.The server might not be sending the appropriate intermediate certificates.An additional root certificate may need to be imported.Error code: SEC_ERROR_UNKNOWN_ISSUER

Is this the cause of the issue?
why is the certificate alright in chrome?

Comment 7

[Patrick Toomey]

Hmm...so did you have to manually accept the cert when you first accessed `http://github.factset.com`? Might there be some difference between Firefox/Chrome on whether you need to re-accept for subdomains that use the same cert? Can you try manually navigating to `assets.github.factset.com` to see?

Comment 8

[me_theonlyone]

genius!! patrick that worked!!
i mean although some bits are still not loaded correctly, at least the website looks closer to normal. 

thank you very much.
I'll try playing around with more of the unsuccessful stuff and see if there are more security exceptions to be added.

Comment 9

[me_theonlyone]

assets.github.factset.com
avatars.github.factset.com
security exceptions had to be added. 
Thank you very much guys. 
now I know what to check first when an intranet page doesn't load correctly. 

how do i resolve this?

Comment 10

[Patrick Toomey]

You either need to get a non-self-signed cert installed on the server or you need to add the self-signed trusted root cert to your cert store so that the browser trusts that cert without having manually add it for each site.

Comment 11

[Frederik Braun [:freddy]]

Thank you so much me_theonlyone and Patrick for jointly resolving this issue!
Closing this bug, as it's not in Firefox but an operation problem for the specific GitHub enterprise installation.