Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-33653

HTML Publisher artifact does not load js script

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not A Defect
    • Icon: Major Major
    • htmlpublisher-plugin
    • Jenkins Version 1.651
      HTML Publisher plugin: 1:11
      OS: Windows 7 64 bits

      Current Jenkins CSP settings:
      Result: sandbox; default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';

      However, when trying to access some TestNG/ReportNG generated reports, the console shows the error message below. Basically I cannot expand a Java StackTrace, because this requires a small javascript to run. Hard to say if this is a plugin issue or jenkins issue..

      Refused to load the script 'http://

      {my.domain}

      :8080/job/Web%20check%20-%20PRODUCTION/115/HTMLReport/reportng.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline'".

        1. System Information [Jenkins].pdf
          134 kB

          [JENKINS-33653] HTML Publisher artifact does not load js script

          Vasile Pop created issue -

          mcrooney added a comment -

          Thanks for the report! danielbeck, any thoughts on this?

          mcrooney added a comment - Thanks for the report! danielbeck , any thoughts on this?

          Daniel Beck added a comment -

          My best guess is the CSP settings were adapted to make this work, and then the cache-bypassing browser reload was forgotten.

          Daniel Beck added a comment - My best guess is the CSP settings were adapted to make this work, and then the cache-bypassing browser reload was forgotten.

          Vasile Pop added a comment -

          I tried reloading the page several times using Shift + F5, this should clear the cache, right? It did not work.

          Vasile Pop added a comment - I tried reloading the page several times using Shift + F5, this should clear the cache, right? It did not work.

          Daniel Beck added a comment -

          What's the CSP header value returned from Jenkins? What's the output of System.getProperty("hudson.model.DirectoryBrowserSupport.CSP") in the script console?

          Daniel Beck added a comment - What's the CSP header value returned from Jenkins? What's the output of System.getProperty("hudson.model.DirectoryBrowserSupport.CSP") in the script console?

          Vasile Pop added a comment -

          Result: sandbox; default-src 'self'; script-src 'unsafe-inline'

          When I logged the issue it was:

          Result: sandbox; default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';

          Vasile Pop added a comment - Result: sandbox; default-src 'self'; script-src 'unsafe-inline' When I logged the issue it was: Result: sandbox; default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';

          Daniel Beck added a comment -

          These options need to be persisted in the startup scripts to survive a Jenkins restart. But set it again to the value you want and reload to make sure it works as expected.

          Daniel Beck added a comment - These options need to be persisted in the startup scripts to survive a Jenkins restart. But set it again to the value you want and reload to make sure it works as expected.

          Vasile Pop added a comment -

          That's exactly what I did. Jenkins starts as a service configured as described. And it worked until a week ago, unfortunately I don't know what event made this not working anymore. Even if I configure this option for the current instance, it's not working.

          Vasile Pop added a comment - That's exactly what I did. Jenkins starts as a service configured as described. And it worked until a week ago, unfortunately I don't know what event made this not working anymore. Even if I configure this option for the current instance, it's not working.

          Daniel Beck added a comment -

          To clarify, you set System.setProperty(…) in the script console, and the subsequent System.getProperty(…) returns the old value you replaced?

          Please provide the full output on the /systemInfo URL.

          Daniel Beck added a comment - To clarify, you set System.setProperty(…) in the script console, and the subsequent System.getProperty(…) returns the old value you replaced? Please provide the full output on the /systemInfo URL.
          Vasile Pop made changes -
          Attachment New: System Information [Jenkins].pdf [ 32221 ]

            r2b2_nz Richard Bywater
            vicus Vasile Pop
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: