Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(grouping): Add unsafe-eval and unsafe-inline grouping test inputs #81539

Merged
merged 2 commits into from
Dec 3, 2024

Conversation

lobsterkatie
Copy link
Member

@lobsterkatie lobsterkatie commented Dec 2, 2024

This adds two new grouping test inputs, to show how we handle CSP reports with unsafe-eval and unsafe-inline violations, which are cases we don't currently cover with our grouping tests.

Note that there are two bugs which currently affect how we handle such inputs:

  • We don't currently recognize such reports for grouping metadata purposes (this is very soon to be fixed), which is why for now they're being recorded in the metadata snapshots as being grouped by an unknown method.

  • We handle such reports backwards at the ingest level, marking events which aren't either unsafe-eval- or unsafe-inline-type violations as one or the other. (Unclear how soon this will be fixed, as it went undetected for five years and no one has yet complained about it.) For now, the input data includes the necessary values to trigger the relevant handlers, but each also includes a TODO so that it can be updated once the underlying bug is fixed. (See [CSP] Incorrect script-src handling relay#4323 and [CSP] Update script-src handling once relay bug is fixed #81531.)

@github-actions github-actions bot added Scope: Frontend Automatically applied to PRs that change frontend components Scope: Backend Automatically applied to PRs that change backend components labels Dec 2, 2024

This comment was marked as off-topic.

@lobsterkatie lobsterkatie removed the Scope: Frontend Automatically applied to PRs that change frontend components label Dec 2, 2024
Copy link

codecov bot commented Dec 2, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #81539   +/-   ##
=======================================
  Coverage   80.45%   80.45%           
=======================================
  Files        7241     7241           
  Lines      321496   321586   +90     
  Branches    20807    20807           
=======================================
+ Hits       258651   258744   +93     
+ Misses      62446    62443    -3     
  Partials      399      399           

@lobsterkatie lobsterkatie force-pushed the kmclb-add-csp-script-src-violation-test-inputs branch from 7fddc84 to 17c0b65 Compare December 3, 2024 17:56
@github-actions github-actions bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Dec 3, 2024
@lobsterkatie lobsterkatie removed the Scope: Frontend Automatically applied to PRs that change frontend components label Dec 3, 2024
@lobsterkatie lobsterkatie marked this pull request as ready for review December 3, 2024 18:23
@lobsterkatie lobsterkatie requested a review from a team as a code owner December 3, 2024 18:23
@lobsterkatie lobsterkatie merged commit 07e4fa6 into master Dec 3, 2024
48 checks passed
@lobsterkatie lobsterkatie deleted the kmclb-add-csp-script-src-violation-test-inputs branch December 3, 2024 18:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Scope: Backend Automatically applied to PRs that change backend components
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants