1530602 - When tapping on "Custom Action..." the screen goes blank (EvalError: "call to Function() blocked by CSP")

Status: RESOLVED FIXED

(Tree Management :: Treeherder, defect, P1)

Description

[Cristian Brindusan [:cbrindusan]]

To repro this issue, login, tap on a job and choose "Custom Action..." and observe how the screen goes blank.
After refresh, the page goes back to normal.

Comment 1

[Cristian Brindusan [:cbrindusan]]

Attachment: image_2019_02_26T07_30_58_326Z.png

Comment 2

[Ed Morley [:emorley]]

In the browser console I see:

Error compiling schema, function code: ...

Followed by:

EvalError: "call to Function() blocked by CSP"

This is due to bug 1270157.

Unfortunately it looks like ajv requires unsafe-eval, yuck. This did show up in New Relic insights, however looked similar to the violations from junk scripts browser extensions inject in the page.

Comment 3

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/treeherder/pull/4703

Comment 5

[Ed Morley [:emorley]]

Temporarily added 'unsafe-eval' to CSP script-src so that ajv.compile() works:
https://github.com/mozilla/treeherder/commit/5986749757406552f2ce088e70bee878ad001088

Deploying now, should be live in the next couple of minutes. Sorry for the breakage.

I really wish Firefox's error reporting for CSP violations were better - at the moment violations from browser addons injecting scripts (eg LastPass or Adblock) look just like real usages of eval() or similar, so hard to tell them apart.

Bug 1530607 is filed for figuring our how to stop using ajv, so we can remove this use of 'unsafe-eval' again - given that it somewhat defeats the point of using CSP.