Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add nonces to <script> for ExtScheduler views #1263

Merged
merged 1 commit into from
Feb 22, 2025

Conversation

labkey-jeckels
Copy link
Contributor

Rationale

ContentSecurityPolicy warning on page: https://prime.ohsu.edu/extscheduler/ONPRC/ResourceScheduler/Flow%20Cytometry%20Core/weeklyTest.view?returnUrl=%2Fproject%2FONPRC%2FResourceScheduler%2FFlow%2520Cytometry%2520Core%2Fbegin.view
{
  "labkeyVersion": "24.11-SNAPSHOT",
  "csp-report": {
    "referrer": "https://prime.ohsu.edu/project/ONPRC/ResourceScheduler/Flow%20Cytometry%20Core/begin.view",
    "status-code": 200,
    "disposition": "report",
    "script-sample": "",
    "violated-directive": "script-src-elem",
    "original-policy": "default-src 'self';connect-src 'self' https://jbrowse.org https://s3.amazonaws.com https://ftp.ncbi.nlm.nih.gov https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com ;object-src 'none' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: ;font-src 'self' data: ;script-src 'unsafe-eval' 'strict-dynamic' 'nonce-2a791c4c14ff8bda';base-uri 'self' ;upgrade-insecure-requests ;frame-ancestors 'self' ;report-uri https://www.labkey.org/admin-contentsecuritypolicyreport.api?labkeyVersion=24.11-SNAPSHOT ;",
    "document-uri": "https://prime.ohsu.edu/extscheduler/ONPRC/ResourceScheduler/Flow%20Cytometry%20Core/weeklyTest.view?returnUrl=%2Fproject%2FONPRC%2FResourceScheduler%2FFlow%2520Cytometry%2520Core%2Fbegin.view",
    "effective-directive": "script-src-elem",
    "blocked-uri": "https://prime.ohsu.edu/ExtScheduler/resources/extJs/ext-all.js"
  },
  "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
}

Changes

  • Add nonces

@labkey-jeckels
Copy link
Contributor Author

@brentlogan @jryurkanin FYI, this will address one of the CSP violations I found in my analysis

@brentlogan
Copy link
Collaborator

@labkey-jeckels, thanks! I appreciate the update.

@labkey-jeckels labkey-jeckels merged commit 0a492b1 into release24.11-SNAPSHOT Feb 22, 2025
4 checks passed
@labkey-jeckels labkey-jeckels deleted the 24.11_fb_extSchedulerNonces branch February 22, 2025 16:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants