Bug 395531 - Plasma Integration extension injects scripts into pages where it’s disallowed by Content Security Policy and clutters CSP violation reports
Summary: Plasma Integration extension injects scripts into pages where it’s disallowed...
Status: REOPENED
Alias: None
Product: plasma-browser-integration
Classification: Plasma
Component: general (other bugs)
Version First Reported In: unspecified
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: abogical
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-06-17 16:18 UTC by Pauline Emily
Modified: 2024-09-28 06:31 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments
Console output of test website mentioned in reproduction steps (128.35 KB, image/png)
2020-06-24 17:16 UTC, abogical
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Pauline Emily 2018-06-17 16:18:49 UTC
Plasma Integration extension injects its own scripts into pages where inline scripts are disallowed by Content Security Policy, which promptly get blocked by a browser, and then in pages where 'report-uri' directive is present browser sends two reports for every page, which causes the server-side reports log to be cluttered with violation reports caused by the extension.

Steps to Reproduce:

1) Install Plasma Integration extension.
2) Go to page where Content Security Policy does not allow inline scripts, e.g. https://wandystan.eu/w/.
3) Open browser console.

Actual Results:

There are two errors like this:

> Content Security Policy: Ustawienia strony zablokowały wczytanie zasobu „self” („script-src https://wandystan.eu”). Source: (        function() {            f4207....
> Content Security Policy: Ustawienia strony zablokowały wczytanie zasobu „self” („script-src https://wandystan.eu”). Source: (function() {            var oldCreateE....

And two requests to report URI such as https://wandystan.eu/varia/csp_report.php are sent.

Expected Results:

There are no errors and no violation is reported.
Comment 1 David Edmundson 2018-06-20 13:12:16 UTC
Resolved for now in plugin 1.1
Comment 2 Pauline Emily 2018-06-20 13:21:47 UTC
OK, now it works as it should. Thanks!
Comment 3 abogical 2020-06-24 17:16:43 UTC
Created attachment 129640 [details]
Console output of test website mentioned in reproduction steps

I am still getting the same CSP error within my console. This bug could've resurfaced. See attachment.
Comment 4 Alexander Opitz 2021-06-08 09:56:08 UTC
Host Version: 5.21.5
Extension Version: 1.8.0.1

And same issue here

Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf inline blockiert ("script-src").
Comment 5 mani.reini 2024-02-07 14:26:22 UTC
Still regularly running into this problem, is there any way to support?
Comment 6 Kai Uwe Broulik 2024-09-28 06:31:07 UTC
Is this still an issue? The latest 1.9/2.0 version shouldn’t inject dynamic JavaScript anymore I think.