style import isn't rewritten

[pascalgross]

I'm serving a private web app using browZer (ghcr.io/openziti/ziti-browzer-bootstrapper:latest which is 0.63.4).

The webapp is loading, but styles aren't correctly displayed.
I noticed, how those styles are meant to be loaded (from the index).

`

<style type="text/css">@import "http://ad-appsrv01.ad.xyz.de/Xaver/extern/Coll_beuth_vrm_tb/dojoxaver-7.7.5.7/xaver/themes/base/base.css";</style> <style type="text/css">@import "http://ad-appsrv01.ad.xyz.de/Xaver/extern/tb/layout_Default.css";</style> <script type="text/javascript" src="https://tb.ziti.xyz.de/Xaver/extern/Coll_beuth_vrm_tb/dojoxaver-7.7.5.7/dojo/dojo.js" djconfig="parseOnLoad:true,isWebXaver:false,locale:'de'"></script>

`

http://ad-appsrv01.ad.xyz.de is the private server which isn't visible to the internet.
This causes two problems:

1. this poses a mixed content request (to http from https), which is blocked by the browser
2. the private address is not reachable from the internet

The expected behaviour would be, that the address is rewritten like all other src= addresses.

[rentallect]

@pascalgross I might not completely understand what you're encountering, so to help clarify for me:

Are you saying your web app emits HTML that includes <style> tags that contain @import directives, and browZer doesn't adjust the URL?

My understanding is that the @import rule cannot be used directly within an HTML <style> tag, and that the @import rule is specifically designed to be used within CSS stylesheets, not inline styles.

[pascalgross]

Are you saying your web app emits HTML that includes <style> tags that contain @import directives, and browZer doesn't adjust the URL?

Exactly.

My understanding is that the @import rule cannot be used directly within an HTML <style> tag, and that the https://github.com/import rule is specifically designed to be used within CSS stylesheets, not inline styles.

That was my understanding until today, too.

Nevertheless I asked myself: shouldn’t BrowZer substitute those URIs anywhere in the code, regardless if it is valid or not? Let’s say an uri is hardcoded in JavaScript for example (maybe BrowZer already does exactly that, I didn’t check)

[rentallect]

What tech (JS framework, etc) is used to create your web app? I'll need to find or create a test app that emits these dubious <style> tags so I can investigate.

[pascalgross]

It is a proprietary publishing server (for PDFs and stuff) probably only available in Germany - but I'm not sure.
It is called Xaver Publishing Platform: https://xaver.doctronic.de/

If you could provide me your IP address (via PN), I could setup a DNAT for testing purposes for you.
Or I could add an edge router of your's to my network (via PN as well)?