Closed Bug 1316393 Opened 8 years ago Closed 7 years ago

JSON Viewer broken by CSP base-uri

Categories

(DevTools :: JSON Viewer, defect, P2)

defect

Tracking

(firefox52 wontfix, firefox56 verified)

VERIFIED FIXED
Firefox 56
Tracking Status
firefox52 --- wontfix
firefox56 --- verified

People

(Reporter: Felipe, Assigned: Oriol)

References

()

Details

Attachments

(2 files, 1 obsolete file)

I don't know what's particular about this page, but it breaks the JSON Viewer. Instead of loading correctly, it dumps the original JSON content, along with the HTTP headers, as a JSON text dump in the main page. Note: this is not a recent regression. I bisected this and it went back to the time when devtools.jsonviewer.enabled was flipped to true for Nightly (in March)
I don't understand what's the reported problem. Can you please provide STR? Honza
Has STR: --- → no
Priority: -- → P4
Attached image bug1173548.png (deleted) —
Sure, just access the URL with and without devtools.jsonview.enabled true. https://addons.mozilla.org/api/v3/addons/addon/addictive_typing_lessons@tomkennedy.net/feature_compatibility/ See screenshot. With the jsonviewer activated, the UI doesn't show up. Instead, the data of the jsonviewer is dumped as plaintext alongside with the actual content.
Thanks, I can see it now. Honza
Priority: P4 → P2
Mass wontfix for bugs affecting firefox 52.
This is because of the CSP. It blocks both the styles that hid the headers and the script that loads the JSON Viewer. At least, after bug 1367894 you will only see the raw JSON, without the headers.
Attached patch json-csp.patch (obsolete) (deleted) — Splinter Review
The problem is that CSP can prevent a baseURI change. The workaround is using absolute URIs. And for some reason, then .js extensions are needed.
Assignee: nobody → oriol-bugzilla
Status: NEW → ASSIGNED
Attachment #8879944 - Flags: review?(odvarko)
Summary: JSON Viewer broken with this URL → JSON Viewer broken by CSP base-uri
Comment on attachment 8879944 [details] [diff] [review] json-csp.patch Review of attachment 8879944 [details] [diff] [review]: ----------------------------------------------------------------- Thanks for working on this. The patch fixes the problem for me. R+, but it would be great to have a note about the reason why we are using explicit '.js' file extension. Perhas we could introduce a README.md (in devtools/client/jsonview dir). Just like e.g. the netmonitor has it. Honza ::: devtools/client/jsonview/converter-child.js @@ +205,5 @@ > } else { > os = "linux"; > } > > + let baseURI = "resource://devtools/client/jsonview/"; Please make a comment about why we are using absolute URI
Attachment #8879944 - Flags: review?(odvarko) → review+
Attached patch json-csp.patch (deleted) — Splinter Review
The .js extensions were needed because I didn't change baseUrl in requirejs config.
Attachment #8879944 - Attachment is obsolete: true
Attachment #8880578 - Flags: review?(odvarko)
Comment on attachment 8880578 [details] [diff] [review] json-csp.patch Review of attachment 8880578 [details] [diff] [review]: ----------------------------------------------------------------- Thanks! R+, assuming try is green Honza
Attachment #8880578 - Flags: review?(odvarko) → review+
Keywords: checkin-needed
Pushed by ryanvm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/cbf8e6de9bf7 Circumvent CSP base-uri restriction in JSON Viewer. r=Honza
Keywords: checkin-needed
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → Firefox 56
I have reproduced this bug with nightly 52.0a1 (2016-11-09) on "Linux Mint (64 Bit). The bug's fix is now verified on Latest Nightly 56.0a1 Build ID 20170630100234 User Agent Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/56.0 [Bugday-20170628]
Marking this bug as verified fixed, per comment 13.
Status: RESOLVED → VERIFIED
Product: Firefox → DevTools
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: