Proxy conflicts with dynamically added content security policy #6057

Aaronius · 2021-03-17T16:40:58Z

What is your Test Scenario?

I'll describe a simplified version of our test scenario:
We have a test that runs on a page that adds a content security policy via JavaScript, then sends a request to example.com, which is one of the hosts listed in the connect-src directive in the content security policy.

What is the Current behavior?

The test fails because the request to example.com is blocked. Although our request is intended to go to example.com, hammerhead (I assume) is changing our request URL to look like:

http://192.168.1.131:55623/DmakYsj4z*YtOF8upra!a!1!localhost%3A3000/https://example.com

which gets blocked by the CSP, because 192.168.1.131 isn't listed as an allowed host in the CSP.

This seems to be a fairly new issue (1.11.0 or possibly earlier). We did not run into this issue on 1.10.0.

What is the Expected behavior?

I would expect the request to example.com to succeed, because the host is allowed by the CSP.

What is your web application and your TestCafe test code?

Your website URL (or attach your complete example):

<!DOCTYPE html>
<html lang="en">
  <head>
    <title>React App</title>
    <script>
      const meta = document.createElement("meta");
      meta.httpEquiv = "Content-Security-Policy";
      meta.content = `default-src 'self';
                  script-src 'self' 'unsafe-inline';
                  style-src 'self' 'unsafe-inline';
                  connect-src 'self' *.example.com;`;
      document.head.appendChild(meta);
      fetch("https://example.com");
    </script>
  </head>
  <body>
    <div id="root"></div>
  </body>
</html>

Your complete test code (or attach your test files):

 fixture("CSP").page("http://localhost:3000");

test("should pass without errors", async t => {
  await t.expect(true).eql(true);
});

Your complete test report:

A test run is starting...
 Running tests in:
 - Chrome 89.0.4389.82 / macOS 10.15.7

 CSP
 ✖ should pass without errors

   1) A JavaScript error occurred on "http://localhost:3000/".
      Repeat test actions in the browser and check the console for errors.
      If you see this error, it means that the tested website caused it. You can fix it or disable tracking JavaScript errors in TestCafe. To do the latter, enable the "--skip-js-errors"
      option.
      If this error does not occur, please write a new issue at:
      "https://github.com/DevExpress/testcafe/issues/new?template=bug-report.md".
      
      JavaScript error details:
      TypeError: Failed to fetch
          at fetch (http://192.168.1.131:55622/hammerhead.js:9:578)
          at http://localhost:3000/:20:7

      Browser: Chrome 89.0.4389.82 / macOS 10.15.7



 1/1 failed (0s)

Steps to Reproduce:

You can clone https://github.com/Aaronius/testcafe-bugs
Check out the csp branch.
Run npm install
Run npm start
In a different terminal, run npm test

Your Environment details:

testcafe version: 1.12.0
node.js version: 14.15.3
command-line arguments: testcafe chrome
browser name and version: Chrome 89.0 (the same problem occurs on Safari and Firefox, at least)
platform and version: macOS 10.15.7
other: This problem only occurs when the CSP is dynamically added using JavaScript. If the CSP is part of the HTML and not added by JavaScript, no issue occurs.

The text was updated successfully, but these errors were encountered:

felis2803 · 2021-03-18T08:01:55Z

Hello,

Thank you for your report. I reproduced this behavior. We need some time to research it. For now, use the '--skip-js-errors' flag as a workaround.

Aaronius · 2021-03-18T15:16:07Z

Thanks @felis2803. Unfortunately, using --skip-js-errors won't work for us. My example showed a simplified version of our test, but in reality our test depends on the request successfully being sent. Thank you for working on this!

Ghost-J · 2021-04-09T13:46:38Z

Hey, has there been an update on this issue, with version 1.14.0 the issue persists? We've noticed that it started with version 1.11.0.

Most likely related to this change:

TestCafe proxy now correctly handles requests that are not permitted by the CORS policy (testcafe-hammerhead/#1263)

Sadly --skip-js-errors doesn't work for us either as the request needs to be successful, for the component to load.

aleks-pro · 2021-04-12T08:17:24Z

Hello @Ghost-J,

We didn't look into this problem yet. So, it still persists in TestCafe 1.14.0. We will update this thread once we have any news.

Ghost-J · 2021-08-12T12:07:15Z

Issue still persists with version 1.15.2. Thought I'd push the thread as the bot removed the "need response" state.

PS: Due to not being able to update we aren't able to resolve the issue mentioned here. DevExpress/testcafe-hammerhead#2653

miherlosev · 2021-12-16T09:35:32Z

Hi @Aaronius

This problem only occurs when the CSP is dynamically added using JavaScript. If the CSP is part of the HTML and not added by JavaScript, no issue occurs.

TestCafe is trying to remove CSP directives in tags and headers from the tested page. The case when the meta tag with CSP directives is added to the head tag is not handled correctly.
The issue is still reproduced in testcafe@1.17.2-rc.2.

… (#6781) * Update hammerhead (fix #6633 and fix #6144) * up * update

Ghost-J · 2021-12-29T12:33:06Z

Hi, the issue still persists with testcafe v1.18.1 and hammerhead v17.1.26.

miherlosev · 2021-12-30T08:23:32Z

The fix will be shipped with the next TestCafe version (1.18.2 and above).

Ghost-J · 2022-01-19T11:52:20Z

The issue still seems to persist with testcafe v1.18.2 and hammerhead v.24.5.13

felis2803 · 2022-01-21T12:15:20Z

@Ghost-J, You're right, this issue is still reproducible on testcafe@1.18.2.

need-response-app bot added the STATE: Need response label Mar 17, 2021

need-response-app bot removed the STATE: Need response label Mar 18, 2021

felis2803 added TYPE: bug FREQUENCY: level 1 labels Mar 18, 2021

need-response-app bot added the STATE: Need response label Mar 18, 2021

Aaronius mentioned this issue Mar 18, 2021

Upgraded testcafe and browserstack provider. adobe/alloy#696

Merged

7 tasks

felis2803 removed the STATE: Need response label Mar 19, 2021

need-response-app bot added the STATE: Need response label Apr 9, 2021

need-response-app bot removed the STATE: Need response label Apr 12, 2021

AndreyBelym added FREQUENCY: level 2 and removed FREQUENCY: level 1 labels Nov 2, 2021

miherlosev self-assigned this Dec 16, 2021

miherlosev removed their assignment Dec 16, 2021

miherlosev added the SYSTEM: hammerhead label Dec 16, 2021

LavrovArtem self-assigned this Dec 23, 2021

LavrovArtem mentioned this issue Dec 24, 2021

the 'httpEquiv' property of the HtmlMetaElement is overridden DevExpress/testcafe-hammerhead#2721

Merged

LavrovArtem linked a pull request Dec 24, 2021 that will close this issue

Update hammerhead (fix #6633 and fix #6144 and fix #5796 and fix #6057) #6781

Merged

miherlosev closed this as completed in #6781 Dec 27, 2021

need-response-app bot added the STATE: Need response label Dec 29, 2021

need-response-app bot removed the STATE: Need response label Dec 30, 2021

need-response-app bot added the STATE: Need response label Jan 19, 2022

felis2803 reopened this Jan 21, 2022

need-response-app bot removed the STATE: Need response label Jan 21, 2022

miherlosev assigned miherlosev and unassigned LavrovArtem Jun 28, 2022

miherlosev mentioned this issue Jun 28, 2022

fix: refix http-equiv processing DevExpress/testcafe-hammerhead#2779

Merged

miherlosev closed this as completed in DevExpress/testcafe-hammerhead#2779 Jun 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Proxy conflicts with dynamically added content security policy #6057

Proxy conflicts with dynamically added content security policy #6057

Aaronius commented Mar 17, 2021 •

edited

Loading

felis2803 commented Mar 18, 2021

Aaronius commented Mar 18, 2021

Ghost-J commented Apr 9, 2021

aleks-pro commented Apr 12, 2021

Ghost-J commented Aug 12, 2021 •

edited

Loading

miherlosev commented Dec 16, 2021

Ghost-J commented Dec 29, 2021

miherlosev commented Dec 30, 2021

Ghost-J commented Jan 19, 2022

felis2803 commented Jan 21, 2022

Proxy conflicts with dynamically added content security policy #6057

Proxy conflicts with dynamically added content security policy #6057

Comments

Aaronius commented Mar 17, 2021 • edited Loading

What is your Test Scenario?

What is the Current behavior?

What is the Expected behavior?

What is your web application and your TestCafe test code?

Steps to Reproduce:

Your Environment details:

felis2803 commented Mar 18, 2021

Aaronius commented Mar 18, 2021

Ghost-J commented Apr 9, 2021

aleks-pro commented Apr 12, 2021

Ghost-J commented Aug 12, 2021 • edited Loading

miherlosev commented Dec 16, 2021

Ghost-J commented Dec 29, 2021

miherlosev commented Dec 30, 2021

Ghost-J commented Jan 19, 2022

felis2803 commented Jan 21, 2022

Aaronius commented Mar 17, 2021 •

edited

Loading

Ghost-J commented Aug 12, 2021 •

edited

Loading