search

garris / BackstopJS

Catch CSS curve balls.
http://backstopjs.org
MIT License
6.71k stars 602 forks source link

Jenkins "HTML report" page is blank #1171

Open janmashat opened 4 years ago

janmashat commented 4 years ago

Following the "Publish HTML reports" instructions detailed here: https://github.com/garris/BackstopJS/tree/master/examples/Jenkins

The resulting page in Jenkins is empty: Screenshot 2020-04-03 at 11 24 30

I'm assuming this is due to the javascript in the BackstopJS page conflicting with the built-in Jenkins javascript, or other script execution being blocked.

hubidu commented 4 years ago

It's because of CORS issues (because the backstop report uses inline styles) which are prohibited on your jenkins. I have the same problem.

websolutions-hamburg commented 2 years ago

This can help:

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "")

More information: https://stackoverflow.com/a/46197356/11217161 https://www.jenkins.io/doc/book/security/configuring-content-security-policy/

tkrah commented 8 months ago

That is not really a good solution to clear the CSP. Why not fix the generated report to move the inline styles to a css file + load that and put the inline JavaScript to a js file and load that too, that way it should be CSP compatible if at least 'self' is set?

dgrebb commented 8 months ago

This is all CSP — no CORS issues.

tl;dr — this came up for me the other day, and I'm working out a solution (and pull-request).

I think the quick fix is to relax headers coming from Jenkins for frame-src, script-src, and style-src. Or remove them entirely and [set them via <meta http-equiv> tag]() in the (customized) report.

The long-term solution requires some refactoring of the BackstopJS reporting application. nonce, hash, and moving everything to a custom loader are all possibilities.

I had a feeling this would come up at some point. Wow — CSP is 20 years old?

Another issue a lot of folks will begin running into — injected CSS/JS via onBeforeScript and onReadyScript on a server/page with strong "'self'" policies will fail. Migrating any application or site to more secure CSP will break once-working BackstopJS tests.

@tkrah thanks for reviving this issue.

If anyone comes across this and has use-cases to share, please do.

dgrebb commented 8 months ago

FWIW — there's some good history in this thread: Page with CSP breaks puppeteer