1531405 - Gather telemetry on cross-origin style sheet Content-Type headers

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P2)

Description

[Anne (:annevk)]

Currently anything lacking a Content-Type header or having a Content-Type header that cannot be parsed, can be used as a cross-origin style sheet. It would be good to know to what extent such resources exist.

Ideally we log all Content-Type header values (or the lack of the header).

Comment 1

[Anne (:annevk)]

For this particular part of CORB++ it would be good to get telemetry sooner rather than later because if we cannot enforce text/css for style sheets we will have to rethink the design.

Comment 2

[Neha Kochar [:neha]]

Dave, would it be possible to add telemetry for this?

Comment 3

[Boris Zbarsky [:bzbarsky]]

The relevant place to add this telemetry is presumably at https://searchfox.org/mozilla-central/rev/878bbf3cb8897a208454df27535f3522ab482cf2/netwerk/protocol/http/nsHttpChannel.cpp#1821-1824 in the case when mContentTypeHint is "text/css" (or the loadinfo type is TYPE_STYLESHEET; those should be pretty equivalent, modulo XSLT). As in, this would need to be done in networking code; by the time the style loader sees things it just sees "text/css" for these sorts of loads.

Comment 4

[Valentin Gosu [:valentin] (he/him)]

It seems that we can use Telemetry::RecordEvent to record arbitrary contentType strings.
I'll write up a patch ASAP.

Comment 5

[Boris Zbarsky [:bzbarsky]]

That's definitely going to need a data review...

Comment 6

[Anne (:annevk)]

I think we need to measure 4 things initially which are hopefully fine without data review. For a cross-origin style sheet:

• 1) Are there Content-Type headers?
• Is the result of extracting a MIME type (and ignoring MIME type parameters) from the Content-Type headers 2) failure, 3) text/css, or 4) another MIME type?

(In particular ideally we do not equate lack of Content-Type headers or failure to parse them with text/css.)

Comment 7

[Valentin Gosu [:valentin] (he/him)]

(In reply to Anne (:annevk) from comment #6)

I think we need to measure 4 things initially which are hopefully fine without data review.

As far as I know, all new telemetry probes need data review - the only difference is that not reporting arbitrary strings makes it much less risky.

For a cross-origin style sheet:

• 1) Are there Content-Type headers?
• Is the result of extracting a MIME type (and ignoring MIME type parameters) from the Content-Type headers 2) failure, 3) text/css, or 4) another MIME type?
  (In particular ideally we do not equate lack of Content-Type headers or failure to parse them with text/css.)

My approach here is:
In nsHttpChannel::CallOnStartRequest I record whether there are any Content-Type headers present in the response.
In nsHttpChannel::OnStopRequest if mStatus is success (I presume we only want telemetry for successful channels) and this is a cross-origin style sheet - I check the value of GetContentType() and report the following to telemetry:
CT present in OnStartRequest & CT in OnStopRequest is either empty, text/css, otherValue

Comment 8

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1531405 - Gather telemetry on cross-origin style sheet Content-Type headers r=JuniorHsu!,annevk

Comment 9

[Valentin Gosu [:valentin] (he/him)]

Attachment: request.md

Comment 10

[Chris H-C :chutten]

Comment on attachment 9098502 [details]
request.md

Load balancing to Martin.

Comment 11

[mlopatka]

Thanks for the data review request. I'd like to request clarification on one item.

5. List all proposed measurements and indicate the category of data collection for each measurement, using the Firefox data collection categories on the Mozilla wiki.

Whether cross-origin stylesheet responses had a Content-Type, if it was successfully parsed, and if it parsed as text

It seems to me that these values can all be encoded as Boolean types.
Can you please specify the data collection schema for these three measurements:

• presence/absence of a cross-origin stylesheet
• presence/absence of a Content-Type in the responses
• Boolean specifying that the Content-Type (if present) was parsed as text True/False

Furthermore, at what level of aggregation will these values be reported?

Comment 12

[Valentin Gosu [:valentin] (he/him)]

(In reply to mlopatka from comment #11)

Thanks for the data review request. I'd like to request clarification on one item.

5. List all proposed measurements and indicate the category of data collection for each measurement, using the Firefox data collection categories on the Mozilla wiki.

Whether cross-origin stylesheet responses had a Content-Type, if it was successfully parsed, and if it parsed as text

It seems to me that these values can all be encoded as Boolean types.
Can you please specify the data collection schema for these three measurements:

• presence/absence of a cross-origin stylesheet
• presence/absence of a Content-Type in the responses
• Boolean specifying that the Content-Type (if present) was parsed as text True/False

These are all represented as a categorical probe with these categories:
"NoHeader", "EmptyHeader", "FailedToParse", "ParsedTextCSS", "ParsedOther"

Furthermore, at what level of aggregation will these values be reported?

Not sure if reporting the data as a categorical probe counts as aggregation or not.
From what I understand we will not be aggregating the data with any other probes.

Comment 13

[mlopatka]

Thank you for the clarification.
Data review r+

Comment 14

[Valentin Gosu [:valentin] (he/him)]

Thanks for the review!

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fcf12f6e3f64
Gather telemetry on cross-origin style sheet Content-Type headers r=JuniorHsu

Comment 16

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/fcf12f6e3f64

Comment 17

[Anne (:annevk)]

For future reference and whoever is interested, the results of these measurements are noted and analyzed in https://github.com/whatwg/fetch/issues/964.