Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-32092

svg image provided by copy artefact plugin does not show correctly in firefox if jenkins runs via https

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not A Defect
    • Icon: Major Major
    • copyartifact-plugin, core, image-gallery-plugin
    • org.jenkins-ci.main:jenkins-war:1.642
      org.jenkins-ci.plugins:copyartifact:1.37
      com.tupilabs.image_gallery:image-gallery:1.2

      Steps to reproduce:

      • In a job a svg image is created by python/matplotlib (see attachment).
      • The image is copied by the copy artefact plugin
      • The image appears all black if viewed with firefox (version 42 or 43)
      • jenkins is running on https

      Changing the firefox preference security.csp.enable from true to false fixes the problem.

      This seems to be related to this: https://greasyfork.org/de/forum/discussion/353/doesnt-work-because-of-content-security-policy
      https://developer.mozilla.org/en-US/docs/Security/MixedContent/How_to_fix_website_with_mixed_content

        1. sample1.1988.test.svg
          18 kB

          [JENKINS-32092] svg image provided by copy artefact plugin does not show correctly in firefox if jenkins runs via https

          Joachim Herb added a comment - - edited

          Additional information:

          The following error is shown in the browser console of firefox:
          Content Security Policy: The page's settings blocked the loading of a resource: ("style-src https://xxx.xxx.xxx:8080")

          The bug also happens, if the svg file is opened directly from the link created by the copy artifact plugin, so probably not caused by the image gallery plugin

          Joachim Herb added a comment - - edited Additional information: The following error is shown in the browser console of firefox: Content Security Policy: The page's settings blocked the loading of a resource: ("style-src https://xxx.xxx.xxx:8080 ") The bug also happens, if the svg file is opened directly from the link created by the copy artifact plugin, so probably not caused by the image gallery plugin

          Daniel Beck added a comment -

          https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
          https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

          Daniel Beck added a comment - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

          Bruno P. Kinoshita added a comment -

          Thanks for taking care of that danielbeck. Closing the issue as this seems to have been fixed with CSP in newer versions of Jenkins.

          Bruno P. Kinoshita added a comment - Thanks for taking care of that danielbeck . Closing the issue as this seems to have been fixed with CSP in newer versions of Jenkins.

          Daniel Beck added a comment -

          kinow To clarify, the Dec 9 security fix introduced CSP for DirectoryBrowserSupport, thereby breaking uses like this, and the solution is to customize the CSP header to be less restrictive.

          Daniel Beck added a comment - kinow To clarify, the Dec 9 security fix introduced CSP for DirectoryBrowserSupport, thereby breaking uses like this, and the solution is to customize the CSP header to be less restrictive.

          Joachim Herb added a comment -

          The default value of hudson.model.DirectoryBrowserSupport.CSP is
          sandbox; default-src 'none'; img-src 'self'; style-src 'self';
          To solve the problem with the svg images, I had to change it to
          sandbox; default-src 'none'; img-src 'self'; style-src 'self' 'unsafe-inline';
          see https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

          Joachim Herb added a comment - The default value of hudson.model.DirectoryBrowserSupport.CSP is sandbox; default-src 'none'; img-src 'self'; style-src 'self'; To solve the problem with the svg images, I had to change it to sandbox; default-src 'none'; img-src 'self'; style-src 'self' 'unsafe-inline'; see https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

            kinow Bruno P. Kinoshita
            jherb Joachim Herb
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: