Skip to content

magento/magento2#38933: Putting csp_whitelist.xml in theme does not work and creates intermittent issue #38933 #39672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Apr 29, 2025
Merged

magento/magento2#38933: Putting csp_whitelist.xml in theme does not work and creates intermittent issue #38933 #39672

merged 11 commits into from
Apr 29, 2025
+252 −22

Conversation

NitrogenUA
Copy link
Contributor

@NitrogenUA NitrogenUA commented Feb 28, 2025 •
edited
Loading

Description (*)

  • Implemented caching of CSP whitelist per website area.

Fixed Issues (if relevant)

  1. Fixes Putting csp_whitelist.xml in theme does not work and creates intermittent issue #38933

Manual testing scenarios (*)

  • Put csp_whitelist.xml under your frontend theme's etc/ directory. (You can put this in Luma theme too. Just any theme will work).
  • Clear Magento 2 cache.
  • Open Magento 2 admin area page. Using browser DevTools take note of CSP definitions response header.
  • Open Magento 2 storefront, for instance in separate browser tab. Using browser DevTools take note of CSP definitions response header.
  • Verify that theme's CSP whitelist is in effect on Magento 2 storefront by comparing CSP definition headers from each request.

Expected result

Magento 2 storefront CSP whitelist is applied even if admin area was accessed first after the cache reset.

Contribution checklist (*)

  • Pull request has a meaningful description of its purpose
  • All commits are accompanied by meaningful commit messages
  • All new or changed code is covered with unit/integration tests (if applicable)
  • README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
  • All automated tests passed successfully (all builds are green)

@NitrogenUA
magento#38933: Putting csp_whitelist.xml in theme does not work and c…
b60b5f8 
…reates intermittent issue

- Implemented caching of CSP whitelist per website area.
@m2-assistant M2 Assistant
Copy link

m2-assistant bot commented Feb 28, 2025

Hi @NitrogenUA. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.
❗ Automated tests can be triggered manually with an appropriate comment:

  • @magento run all tests - run or re-run all required tests against the PR changes
  • @magento run <test-build(s)> - run or re-run specific test build(s)
    For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:
  1. Database Compare
  2. Functional Tests CE
  3. Functional Tests EE
  4. Functional Tests B2B
  5. Integration Tests
  6. Magento Health Index
  7. Sample Data Tests CE
  8. Sample Data Tests EE
  9. Sample Data Tests B2B
  10. Static Tests
  11. Unit Tests
  12. WebAPI Tests
  13. Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

@m2-github-services m2-github-services added Partner: Perspective partners-contribution Pull Request is created by Magento Partner labels Feb 28, 2025
@NitrogenUA
Copy link
Contributor Author

@magento run all tests

@NitrogenUA
magento#38933: Putting csp_whitelist.xml in theme does not work and c…
f65f4ab 
…reates intermittent issue

- Updated copyright notice.
@NitrogenUA
Copy link
Contributor Author

@magento run all tests

@NitrogenUA
Copy link
Contributor Author

@magento run Functional Tests B2B, Integration Tests

@Priyakshic Priyakshic added the Project: Community Picked PRs upvoted by the community label Mar 13, 2025
@Priyakshic Priyakshic moved this to Pending Review in Community Dashboard Mar 13, 2025
@NitrogenUA
Copy link
Contributor Author

@magento run Functional Tests B2B, Integration Tests

@engcom-Hotel
Copy link
Contributor

As the PR shows as draft in status, hence moving it to hold bucket.

@NitrogenUA Please let us know when the PR is ready for review.

@engcom-Hotel engcom-Hotel moved this from Pending Review to On Hold in Community Dashboard Mar 18, 2025
@NitrogenUA NitrogenUA marked this pull request as ready for review March 21, 2025 13:14
@NitrogenUA
Copy link
Contributor Author

@engcom-Hotel PR is ready for review.

@engcom-Hotel engcom-Hotel moved this from On Hold to Pending Review in Community Dashboard Mar 25, 2025
@engcom-Hotel engcom-Hotel self-requested a review March 25, 2025 06:23
@engcom-Hotel
Copy link
Contributor

@magento run all tests

engcom-Hotel
engcom-Hotel requested changes Mar 25, 2025
View reviewed changes
Copy link
Contributor

@engcom-Hotel engcom-Hotel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @NitrogenUA,

Please add some automated test in accordance to the DOD.

Thanks

@engcom-Hotel engcom-Hotel moved this from Pending Review to Changes Requested in Community Dashboard Mar 25, 2025
@engcom-Hotel engcom-Hotel added Progress: needs update Priority: P2 A defect with this priority could have functionality issues which are not to expectations. and removed Progress: pending review labels Mar 25, 2025
@Den4ik @engcom-Hotel
Update app/code/Magento/Csp/Model/Collector/CspWhitelistXml/FileResol…
e46b06f 
…ver.php

Co-authored-by: Abhinav Pathak <51681618+engcom-Hotel@users.noreply.github.com>
@engcom-Dash
Copy link
Contributor

@magento run all tests

@engcom-Dash engcom-Dash moved this from Changes Requested to Pending Review in Community Dashboard Apr 16, 2025
@ct-prd-projects-boards-automation ct-prd-projects-boards-automation bot moved this from Pending Review to Review in Progress in Community Dashboard Apr 16, 2025
@engcom-Hotel
Copy link
Contributor

@magento run all tests

@ct-prd-projects-boards-automation ct-prd-projects-boards-automation bot moved this from Review in Progress to Ready for Testing in Community Dashboard Apr 21, 2025
@engcom-Bravo engcom-Bravo added the Triage: Dev.Experience Issue related to Developer Experience and needs help with Triage to Confirm or Reject it label Apr 21, 2025
@engcom-Dash
Copy link
Contributor

@magento run all tests

@engcom-Dash engcom-Dash moved this from Ready for Testing to Testing in Progress in Community Dashboard Apr 23, 2025
@engcom-Dash
Copy link
Contributor

HI @NitrogenUA

Thanks for the collaboration & contribution!

✔️ QA Passed

Preconditions:

  1. Install fresh Magento 2.4-develop

Steps to reproduce

  1. Put csp_whitelist.xml under your frontend theme's etc/ directory.
  2. Clear Magento 2 cache.
  3. Open Magento 2 admin area page.
  4. Open Magento 2 storefront. Using browser DevTools take note of CSP definitions response header.
  5. Verify that theme's CSP whitelist is in effect on Magento 2 storefront

Before: ❌

PR-39672-before_1.mp4

After ✔️

PR-39672-After_1.mp4

Builds are failed hence moving this PR for Extended Testing.

Thanks!

@engcom-Dash engcom-Dash moved this from Testing in Progress to Extended testing (optional) in Community Dashboard Apr 23, 2025
@engcom-Dash
Copy link
Contributor

@magento run Functional Tests B2B, Functional Tests CE

@engcom-Dash
Copy link
Contributor

Test failures for Functional B2B are inconsistent and seems to be flaky. They neither part of PR nor failing because of the PR changes.

Build 1: https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/39672/630f1e8bfc5ea654dcf76a2a1c6f2db8/Functional/allure-report-b2b/index.html#categories/bdbf199525818fae7a8651db9eafe741

image

Build 2: https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/39672/a6e3b697ff7d78b35e3bf03e6027e6c0/Functional/allure-report-b2b/index.html#categories/8fb3a91ba5aaf9de24cc8a92edc82b5d

image

Test failures for Functional CE are inconsistent and seems to be flaky. They neither part of PR nor failing because of the PR changes.

Build 1: https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/39672/c114bc4a7a680086651bab6637315301/Functional/allure-report-ce/index.html#categories/8fb3a91ba5aaf9de24cc8a92edc82b5d

image

Build 2: https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/39672/0267a0e951359763def1f920e1bf3509/Functional/allure-report-ce/index.html#categories/8fb3a91ba5aaf9de24cc8a92edc82b5d

image

Hence moving this PR in Merge In Progress.

@engcom-Dash engcom-Dash moved this from Extended testing (optional) to Merge in Progress in Community Dashboard Apr 24, 2025
@magento-devops-reposync-svc magento-devops-reposync-svc merged commit 0c70667 into magento:2.4-develop Apr 29, 2025
10 of 12 checks passed
@ct-prd-projects-boards-automation ct-prd-projects-boards-automation bot moved this from Merge in Progress to Recently Merged in Community Dashboard Apr 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@engcom-Dash engcom-Dash

@engcom-Hotel engcom-Hotel

@Den4ik Den4ik

Assignees

@engcom-Dash engcom-Dash

Labels
Partner: Perspective partners-contribution Pull Request is created by Magento Partner Priority: P2 A defect with this priority could have functionality issues which are not to expectations. Project: Community Picked PRs upvoted by the community Triage: Dev.Experience Issue related to Developer Experience and needs help with Triage to Confirm or Reject it
Projects
Community Dashboard
Status: Recently Merged
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Putting csp_whitelist.xml in theme does not work and creates intermittent issue
8 participants
@NitrogenUA @engcom-Hotel @engcom-Dash @Den4ik @engcom-Bravo @magento-devops-reposync-svc @m2-github-services @Priyakshic