Closed
Bug 1316393
Opened 8 years ago
Closed 7 years ago
JSON Viewer broken by CSP base-uri
Categories
(DevTools :: JSON Viewer, defect, P2)
DevTools
JSON Viewer
Tracking
(firefox52 wontfix, firefox56 verified)
VERIFIED
FIXED
Firefox 56
People
(Reporter: Felipe, Assigned: Oriol)
References
()
Details
Attachments
(2 files, 1 obsolete file)
(deleted),
image/png
|
Details | |
(deleted),
patch
|
Honza
:
review+
|
Details | Diff | Splinter Review |
I don't know what's particular about this page, but it breaks the JSON Viewer. Instead of loading correctly, it dumps the original JSON content, along with the HTTP headers, as a JSON text dump in the main page.
Note: this is not a recent regression. I bisected this and it went back to the time when devtools.jsonviewer.enabled was flipped to true for Nightly (in March)
Comment 1•8 years ago
|
||
I don't understand what's the reported problem.
Can you please provide STR?
Honza
Has STR: --- → no
Priority: -- → P4
Reporter | ||
Comment 2•8 years ago
|
||
Sure, just access the URL with and without devtools.jsonview.enabled true.
https://addons.mozilla.org/api/v3/addons/addon/addictive_typing_lessons@tomkennedy.net/feature_compatibility/
See screenshot. With the jsonviewer activated, the UI doesn't show up. Instead, the data of the jsonviewer is dumped as plaintext alongside with the actual content.
Updated•8 years ago
|
Has STR: no → yes
Comment 4•8 years ago
|
||
Mass wontfix for bugs affecting firefox 52.
Assignee | ||
Comment 5•7 years ago
|
||
This is because of the CSP. It blocks both the styles that hid the headers and the script that loads the JSON Viewer.
At least, after bug 1367894 you will only see the raw JSON, without the headers.
Assignee | ||
Comment 6•7 years ago
|
||
The problem is that CSP can prevent a baseURI change. The workaround is using absolute URIs. And for some reason, then .js extensions are needed.
Assignee: nobody → oriol-bugzilla
Status: NEW → ASSIGNED
Attachment #8879944 -
Flags: review?(odvarko)
Assignee | ||
Updated•7 years ago
|
Summary: JSON Viewer broken with this URL → JSON Viewer broken by CSP base-uri
Comment 7•7 years ago
|
||
Comment on attachment 8879944 [details] [diff] [review]
json-csp.patch
Review of attachment 8879944 [details] [diff] [review]:
-----------------------------------------------------------------
Thanks for working on this. The patch fixes the problem for me.
R+, but it would be great to have a note about the reason why we are using explicit '.js' file extension. Perhas we could introduce a README.md (in devtools/client/jsonview dir). Just like e.g. the netmonitor has it.
Honza
::: devtools/client/jsonview/converter-child.js
@@ +205,5 @@
> } else {
> os = "linux";
> }
>
> + let baseURI = "resource://devtools/client/jsonview/";
Please make a comment about why we are using absolute URI
Attachment #8879944 -
Flags: review?(odvarko) → review+
Assignee | ||
Comment 8•7 years ago
|
||
The .js extensions were needed because I didn't change baseUrl in requirejs config.
Attachment #8879944 -
Attachment is obsolete: true
Attachment #8880578 -
Flags: review?(odvarko)
Comment 9•7 years ago
|
||
Comment on attachment 8880578 [details] [diff] [review]
json-csp.patch
Review of attachment 8880578 [details] [diff] [review]:
-----------------------------------------------------------------
Thanks!
R+, assuming try is green
Honza
Attachment #8880578 -
Flags: review?(odvarko) → review+
Comment 10•7 years ago
|
||
Assignee | ||
Updated•7 years ago
|
Keywords: checkin-needed
Comment 11•7 years ago
|
||
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cbf8e6de9bf7
Circumvent CSP base-uri restriction in JSON Viewer. r=Honza
Keywords: checkin-needed
Comment 12•7 years ago
|
||
bugherder |
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
status-firefox56:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → Firefox 56
Comment 13•7 years ago
|
||
I have reproduced this bug with nightly 52.0a1 (2016-11-09) on "Linux Mint (64 Bit).
The bug's fix is now verified on Latest Nightly 56.0a1
Build ID 20170630100234
User Agent Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/56.0
[Bugday-20170628]
Assignee | ||
Comment 15•7 years ago
|
||
Marking this bug as verified fixed, per comment 13.
Status: RESOLVED → VERIFIED
Updated•6 years ago
|
Product: Firefox → DevTools
You need to log in
before you can comment on or make changes to this bug.
Description
•