Page MenuHomePhabricator

Special:GraphSandbox broken due to Content Security Policy
Closed, DeclinedPublic

Description

https://de.wikipedia.org/wiki/Spezial:GraphSandbox is broken. The web console shows CSP violations:

Laden fehlgeschlagen für das <script> mit der Quelle "https://de.wikipedia.org/w/load.php?lang=de&modules=startup&only=scripts&raw=1&skin=vector". Spezial:GraphSandbox:12:1
Einige Cookies verwenden das empfohlene "SameSite"-Attribut inkorrekt. 2
Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf inline blockiert ("script-src"). Spezial:GraphSandbox:6:1
Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf inline blockiert ("script-src"). Spezial:GraphSandbox:9:1
Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf https://de.wikipedia.org/w/load.php?lang=de&modules=startup&only=scripts&raw=1&skin=vector blockiert ("script-src").
Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf inline blockiert ("script-src"). Spezial:GraphSandbox:217:1
Anfrage für Zugriff auf Cookies oder Speicher für "https://login.wikimedia.org/wiki/Special:CentralAutoLogin/checkLoggedIn?wikiid=dewiki&proto=https&type=1x1" wurde blockiert, weil alle Anfragen für Speicherzugriff für nicht direkt aufgerufene Websites (Drittanbieter) blockiert werden und das Blockieren von Seitenelementen aktiviert ist.

Not logged in, private window, Firefox 82.0

Related Objects

StatusSubtypeAssignedTask
DeclinedNone
DuplicateNone

Event Timeline

Reedy renamed this task from Spezial:GraphSandbox brocken due to Content Security Policy to Special:GraphSandbox broken due to Content Security Policy.Oct 28 2020, 6:19 PM
Reedy added a project: ContentSecurityPolicy.

Is this still a problem ? Is this problem specific to the content attempting to be rendered ?

I currently cannot reproduce.

Not being logged in in Firefox 98 on https://de.wikipedia.org/wiki/Spezial:GraphSandbox , I get:

Content Security Policy: The report URI (about:blank) should be an HTTP or HTTPS URI.

Content Security Policy: The page’s settings observed the loading of a resource at blob:https://de.wikipedia.org/983087ac-4e3f-4f3d-827b-d7e45ec51bf6 (“worker-src”). A CSP report is being sent.

Some cookies are misusing the recommended “SameSite“ attribute

Cookie “dewikiwmE-sessionTickLastTickTime” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite load.php:1270:111
Cookie “dewikiel-sessionId” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite load.php:1270:111
Cookie “dewikiwmE-sessionTickTickCount” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite 2 load.php:1270:111
Cookie “dewikiel-sessionId” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite load.php:1270:111
Cookie “dewikimwuser-sessionId” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite load.php:1270:111
Jdlrobson changed the task status from Open to Stalled.Apr 25 2023, 12:04 AM
Jdlrobson subscribed.

I'm unclear if this is still an issue. Let's try to reproduce when we are back online.

The Graph extension is being archived.