Infrastructure » sepia

sphinx community is aware of this issue. see also https://trello.com/c/848lTtan/3115-sphinx-doc-sphinx-content-security-policy-3620

weird, i can still see the JavaScript error in https://docs.ceph.com/docs/master/search/?q=crimson.

now we have:

$ curl -I https://docs.ceph.com/docs/master
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 20 Aug 2019 07:04:44 GMT
Content-Type: text/html
Content-Length: 178
Location: https://docs.ceph.com/docs/master/
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'; script-src 'self'
Content-Security-Policy: default-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'self'; script-src-elem 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self'; style-src-elem 'unsafe-inline' 'self'; font-src https://fonts.googleapis.com https://fonts.gstatic.com

and i tested using chromium 76, it complains:

Refused to load the stylesheet 'http://fonts.googleapis.com/css?family=Titillium+Web:400,300,700' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'style-src-elem' was not explicitly set, so 'default-src' is used as a fallback.

Refused to load the stylesheet 'http://fonts.googleapis.com/css?family=Titillium+Web:400,300,700' because it violates the following Content Security Policy directive: "style-src-elem 'unsafe-inline' 'self'".

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-4IfJmohiqxpxzt6KnJiLmxBD72c3jkRoQ+8K5HT5K8o='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

Refused to connect to 'http://docs.ceph.com/docs/master/releases.json' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

so i think we need to

• drop "Content-Security-Policy: default-src 'self'; script-src 'self'" from the header

and change the second "Content-Security-Policy" to:

default-src 'unsafe-inline' 'self' https://docs.ceph.com/;
script-src 'unsafe-inline' 'self' http://ayni.ceph.com;
script-src-elem 'unsafe-inline' 'self' http://ayni.ceph.com;
style-src 'unsafe-inline' 'self' https://fonts.googleapis.com;
style-src-elem 'unsafe-inline' 'self' https://fonts.googleapis.com;
font-src https://fonts.googleapis.com https://fonts.gstatic.com" 

Oh, that is embarrassing. I forgot to comment out the original Content-Security-Policy "default-src 'self'; script-src 'self'"

Is it okay now?

thank you David! much better! now the header looks like

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 22 Aug 2019 08:10:17 GMT
Content-Type: text/html
Content-Length: 178
Location: https://docs.ceph.com/docs/master/
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'self'; script-src-elem 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self'; style-src-elem 'unsafe-inline' 'self'; font-src https://fonts.googleapis.com https://fonts.gstatic.com

so we are able to load inline javascript and style sheets.

but we still cannot load two resources:

[Error] Refused to load https://fonts.googleapis.com/css?family=Titillium+Web:400,300,700 because it does not appear in the style-src directive of the Content Security Policy.

after applying https://github.com/ceph/ceph/pull/29544.

so could you change the new "Content-Security-Policy" to

default-src 'unsafe-inline' 'self';
script-src 'unsafe-inline' 'self';
script-src-elem 'unsafe-inline' 'self' http://ayni.ceph.com;
style-src 'unsafe-inline' 'self' https://fonts.googleapis.com;
style-src-elem 'unsafe-inline' 'self' https://fonts.googleapis.com;
font-src https://fonts.googleapis.com https://fonts.gstatic.com" 

?

where "https://fonts.googleapis.com" is added to "style-src" and "style-src-elem" to cater the needs of different browsers.

Done. I think the fonts are all back to normal now. I really appreciate you doing the research/debugging on this!