Skip to content

Use report-to exclusively in CSPs #7888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
labkey-adam wants to merge 6 commits into
base: develop
Choose a base branch
from
Open

Use report-to exclusively in CSPs #7888

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1f06088
Use report-to exclusively in CSPs
labkey-adam Jul 28, 2026
a9ec1c7
Clean up some warnings and unused methods in JspBase
labkey-adam Jul 28, 2026
c547841
Use MultiSet instead of Bag
labkey-adam Jul 28, 2026
79d0ea9
Better names
labkey-adam Jul 28, 2026
62ace59
"Reporting-Endpoints" header shouldn't require https either
labkey-adam Jul 28, 2026
3cbb563
Update comment now that Firefox supports report-to
labkey-adam Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 12 additions & 19 deletions api/src/org/labkey/api/jsp/JspBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,7 +345,7 @@ public HtmlString checked(boolean checked)
}


private static final HtmlString SELECTED = HtmlString.of(" selected");
private static final HtmlString SELECTED = h(" selected");

/** Returns " selected" (if true) or "" (false) */
public HtmlString selected(boolean selected)
Expand All @@ -359,22 +359,15 @@ public HtmlString selected(Object a, Object b)
return selected(Objects.equals(a,b));
}

/** Returns " selected" (if a.equals(b)) */
public HtmlString selectedEq(Object a, Object b)
{
return selected(null==a ? null==b : a.equals(b));
}


private static final HtmlString DISABLED = HtmlString.of(" disabled");
private static final HtmlString DISABLED = h(" disabled");

/** Returns " disabled" (if true) or "" (false) */
public HtmlString disabled(boolean disabled)
{
return disabled ? DISABLED : EMPTY_STRING;
}

private static final HtmlString READ_ONLY = HtmlString.of(" readonly");
private static final HtmlString READ_ONLY = h(" readonly");

/** Returns " readonly" (if true) or "" (false) */
public HtmlString readonly(boolean readOnly)
Expand All @@ -383,8 +376,8 @@ public HtmlString readonly(boolean readOnly)
}


private static final HtmlString ALTERNATE_ROW = HtmlString.of("labkey-alternate-row");
private static final HtmlString ROW = HtmlString.of("labkey-row");
private static final HtmlString ALTERNATE_ROW = h("labkey-alternate-row");
private static final HtmlString ROW = h("labkey-row");

// Returns "labkey-alternate-row" (true) or "labkey-row" (false)
public HtmlString getShadeRowClass(boolean shade)
Expand Down Expand Up @@ -580,25 +573,25 @@ public HtmlString helpLink(String helpTopic, String displayText)
// Format date using the container-configured date format and HTML filter the result
public HtmlString formatDate(Date date)
{
return HtmlString.of(null == date ? "" : DateUtil.formatDate(getContainer(), date));
return h(null == date ? "" : DateUtil.formatDate(getContainer(), date));
}

// Format LocalDate using the container-configured date format and HTML filter the result
public HtmlString formatDate(LocalDate date)
{
return HtmlString.of(null == date ? "" : DateUtil.formatDate(getContainer(), date));
return h(null == date ? "" : DateUtil.formatDate(getContainer(), date));
}

// Format date & time using the container-configured date & time format and HTML filter the result
public HtmlString formatDateTime(Date date)
{
return HtmlString.of(null == date ? "" : DateUtil.formatDateTime(getContainer(), date));
return h(null == date ? "" : DateUtil.formatDateTime(getContainer(), date));
}

// Format date & time using the specified date & time format and HTML filter the result
public HtmlString formatDateTime(Date date, String pattern)
{
return HtmlString.of(null == date ? "" : DateUtil.formatDateTime(date, pattern));
return h(null == date ? "" : DateUtil.formatDateTime(date, pattern));
}

public String getMessage(ObjectError e)
Expand All @@ -616,7 +609,7 @@ public String getMessage(ObjectError e)

public Errors getErrors(String bean)
{
return (Errors)getViewContext().getRequest().getAttribute(BindingResult.MODEL_KEY_PREFIX + bean);
return (Errors)getViewContext().getRequestOrThrow().getAttribute(BindingResult.MODEL_KEY_PREFIX + bean);
}

protected List<ObjectError> _getErrorsForPath(String path)
Expand Down Expand Up @@ -696,7 +689,7 @@ public List<ObjectError> getErrorsForPath(String path)
if (!_returnedErrors.containsKey(e))
{
missed.add(e);
_returnedErrors.put(e,"missed");
_returnedErrors.put(e, "missed");
}
}
}
Expand Down Expand Up @@ -782,7 +775,7 @@ protected HtmlString formAction(Class<? extends Controller> actionClass, Method
@Deprecated // makeId() is preferred
protected int getRequestScopedUID()
{
return UniqueID.getRequestScopedUID(getViewContext().getRequest());
return UniqueID.getRequestScopedUID(getViewContext().getRequestOrThrow());
}

protected String makeId(String prefix)
Expand Down
14 changes: 2 additions & 12 deletions api/src/org/labkey/filters/ContentSecurityPolicyFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,8 +203,6 @@ private void extractCspVersion(String s)
}
}

private static final String X_FRAME_OPTIONS_HEADER_NAME = "X-Frame-Options";

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
{
Expand All @@ -214,7 +212,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha

if (csp != null)
{
if ("https".equals(req.getScheme()) && resp.getHeader(REPORTING_ENDPOINTS_HEADER) == null)
if (resp.getHeader(REPORTING_ENDPOINTS_HEADER) == null)
{
resp.addHeader(REPORTING_ENDPOINTS_HEADER, _reportingEndpointsHeaderValue);
}
Expand All @@ -231,15 +229,7 @@ private String getSubstitutedCsp(HttpServletRequest req)

if (getType() != ContentSecurityPolicyType.Enforce || !OptionalFeatureService.get().isFeatureEnabled(FEATURE_FLAG_DISABLE_ENFORCE_CSP))
{
Map<String, String> map = Map.of(NONCE_SUBST, getScriptNonceHeader(req));
String csp = expression.eval(map);

if ("https".equals(req.getScheme()))
{
csp = csp + " report-to csp-report ;";
}

return csp;
return expression.eval(Map.of(NONCE_SUBST, getScriptNonceHeader(req)));
}

return null;
Expand Down
4 changes: 2 additions & 2 deletions core/src/org/labkey/core/admin/AdminController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12321,8 +12321,8 @@ public void handleReports(ReportToJsonObjects jsonObjects, HttpServletRequest re
@Override
protected ObjectMapper createRequestObjectMapper()
{
// Annoyingly, Chrome posts an array of JSON objects but Safari posts individual JSON objects. Set a flag
// that ensures both cases deserialize into List<JSONObject>.
// Annoyingly, Chrome and Firefox post an array of JSON objects but Safari posts individual JSON objects.
// Set a flag that ensures both cases deserialize into List<JSONObject>.
return JsonUtil.DEFAULT_MAPPER.copy().enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY);
}
}
Expand Down
6 changes: 3 additions & 3 deletions core/test/src/org/labkey/test/tests/AttachmentsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@
*/
package org.labkey.test.tests;

import org.apache.commons.collections4.Bag;
import org.apache.commons.collections4.bag.HashBag;
import org.apache.commons.collections4.MultiSet;
import org.apache.commons.collections4.multiset.HashMultiSet;
import org.junit.Assert;
import org.junit.BeforeClass;
import org.junit.Test;
Expand Down Expand Up @@ -116,7 +116,7 @@ public void testParentTypesInAuditLog() throws IOException, CommandException
{
SelectRowsResponse auditResponse = new SelectRowsCommand("auditLog", AuditLogHelper.AuditEvent.ATTACHMENT_AUDIT_EVENT.getName()).execute(createDefaultConnection(), getProjectName());
Assert.assertEquals(10, auditResponse.getRowCount());
Bag<String> parentTypes = new HashBag<>();
MultiSet<String> parentTypes = new HashMultiSet<>();
auditResponse.getRowset().forEach(row -> parentTypes.add((String)row.getValue("ParentType")));
Assert.assertEquals(ISSUE_ATTACHMENTS, parentTypes.getCount("IssueComment"));
Assert.assertEquals(WIKI_ATTACHMENTS, parentTypes.getCount("Wiki"));
Expand Down
28 changes: 14 additions & 14 deletions query/src/org/labkey/query/persist/QueryManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@

package org.labkey.query.persist;

import org.apache.commons.collections4.Bag;
import org.apache.commons.collections4.bag.HashBag;
import org.apache.commons.collections4.MultiSet;
import org.apache.commons.collections4.multiset.HashMultiSet;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
Expand Down Expand Up @@ -1058,23 +1058,23 @@ public static void registerUsageMetrics(String moduleName)
if (null != svc)
{
svc.registerUsageMetrics(moduleName, () -> {
Bag<String> bag = DbScope.getDbScopes().stream()
.filter(scope -> !scope.isLabKeyScope()).map(DbScope::getDatabaseProductName)
.collect(Collectors.toCollection(HashBag::new));
MultiSet<String> multiSet = DbScope.getDbScopes().stream()
.filter(scope -> !scope.isLabKeyScope()).map(DbScope::getDatabaseProductName)
.collect(Collectors.toCollection(HashMultiSet::new));

Map<String, Object> statsMap = bag.uniqueSet().stream()
.collect(Collectors.toMap(Function.identity(), bag::getCount));
Map<String, Object> statsMap = multiSet.uniqueSet().stream()
.collect(Collectors.toMap(Function.identity(), multiSet::getCount));

Map<String, Object> metrics = new HashMap<>();
metrics.put("externalDatasources", statsMap);
metrics.put(
"customViewCounts",
Map.of(
"DataClasses", getSchemaCustomViewCounts("exp.data"),
"SampleTypes", getSchemaCustomViewCounts("samples"),
"Assays", getSchemaCustomViewCounts("assay"),
"Inventory", getSchemaCustomViewCounts("inventory")
)
"customViewCounts",
Map.of(
"DataClasses", getSchemaCustomViewCounts("exp.data"),
"SampleTypes", getSchemaCustomViewCounts("samples"),
"Assays", getSchemaCustomViewCounts("assay"),
"Inventory", getSchemaCustomViewCounts("inventory")
)
);
metrics.put("customViewWithLineageColumn", getLineageCustomViewMetrics());
metrics.put("queryDefWithCalculatedFieldsCounts", getCalculatedFieldsCountsMetric());
Expand Down
27 changes: 14 additions & 13 deletions specimen/src/org/labkey/specimen/SpecimenModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@

package org.labkey.specimen;

import org.apache.commons.collections4.bag.HashBag;
import org.apache.commons.collections4.MultiSet;
import org.apache.commons.collections4.multiset.HashMultiSet;
import org.apache.commons.lang3.mutable.MutableInt;
import org.apache.logging.log4j.Logger;
import org.jetbrains.annotations.NotNull;
Expand Down Expand Up @@ -74,12 +75,12 @@
import org.labkey.specimen.importer.SpecimenSettingsImporter;
import org.labkey.specimen.model.SpecimenRequestEventType;
import org.labkey.specimen.pipeline.SpecimenPipeline;
import org.labkey.specimen.requirements.SpecimenRequestRequirementProvider;
import org.labkey.specimen.query.SpecimenPivotByDerivativeType;
import org.labkey.specimen.query.SpecimenPivotByPrimaryType;
import org.labkey.specimen.query.SpecimenPivotByRequestingLocation;
import org.labkey.specimen.query.SpecimenQueryView;
import org.labkey.specimen.query.SpecimenUpdateService;
import org.labkey.specimen.requirements.SpecimenRequestRequirementProvider;
import org.labkey.specimen.security.roles.SpecimenCoordinatorRole;
import org.labkey.specimen.security.roles.SpecimenRequesterRole;
import org.labkey.specimen.settings.RepositorySettings;
Expand Down Expand Up @@ -272,7 +273,7 @@ protected void startupAfterSpringConfig(ModuleContext moduleContext)
{
svc.registerUsageMetrics(NAME, () -> {
// Collect and add specimen repository statistics: simple vs. advanced study count, event/vial/specimen count, count of studies with requests enabled, request count by status
HashBag<String> specimenBag = new HashBag<>();
MultiSet<String> specimenMultiSet = new HashMultiSet<>();
MutableInt requestsEnabled = new MutableInt(0);
MutableInt hasLocations = new MutableInt(0);

Expand All @@ -283,35 +284,35 @@ protected void startupAfterSpringConfig(ModuleContext moduleContext)

if (settings.isSimple())
{
specimenBag.add("simple");
specimenMultiSet.add("simple");
TableInfo simpleSpecimens = schema.getTable(SpecimenTablesProvider.SIMPLE_SPECIMEN_TABLE_NAME);
specimenBag.add("simpleSpecimens", (int) new TableSelector(simpleSpecimens).getRowCount());
specimenMultiSet.add("simpleSpecimens", (int) new TableSelector(simpleSpecimens).getRowCount());
}
else
{
specimenBag.add("advanced");
specimenMultiSet.add("advanced");
TableInfo events = schema.getTable(SpecimenTablesProvider.SPECIMEN_EVENT_TABLE_NAME);
TableInfo vials = schema.getTable(SpecimenTablesProvider.SPECIMEN_DETAIL_TABLE_NAME);
TableInfo specimens = schema.getTable(SpecimenTablesProvider.SPECIMEN_SUMMARY_TABLE_NAME);
specimenBag.add("events", (int) new TableSelector(events).getRowCount());
specimenBag.add("vials", (int) new TableSelector(vials).getRowCount());
specimenBag.add("specimens", (int) new TableSelector(specimens).getRowCount());
specimenMultiSet.add("events", (int) new TableSelector(events).getRowCount());
specimenMultiSet.add("vials", (int) new TableSelector(vials).getRowCount());
specimenMultiSet.add("specimens", (int) new TableSelector(specimens).getRowCount());
}

if (settings.isEnableRequests())
requestsEnabled.increment();

TableInfo locations = schema.getTable(SpecimenQuerySchema.LOCATION_TABLE_NAME);
long locationCount = new TableSelector(locations).getRowCount();
specimenBag.add("locations", (int) locationCount);
specimenBag.add("locationsInUse", (int) new TableSelector(locations, new SimpleFilter(FieldKey.fromParts("In Use"), true), null).getRowCount());
specimenMultiSet.add("locations", (int) locationCount);
specimenMultiSet.add("locationsInUse", (int) new TableSelector(locations, new SimpleFilter(FieldKey.fromParts("In Use"), true), null).getRowCount());
if (locationCount > 0)
hasLocations.increment();

LOG.debug(specimenBag.toString());
LOG.debug(specimenMultiSet.toString());
});

Map<String, Object> specimensMap = specimenBag.uniqueSet().stream().collect(Collectors.toMap(s -> s, specimenBag::getCount));
Map<String, Object> specimensMap = specimenMultiSet.uniqueSet().stream().collect(Collectors.toMap(s -> s, specimenMultiSet::getCount));
Map<String, Object> requestsMap = new SqlSelector(SpecimenSchema.get().getSchema(), new SQLFragment("SELECT Label, COUNT(*) FROM study.SampleRequest INNER JOIN study.SampleRequestStatus srs ON StatusId = srs.RowId GROUP BY Label")).getValueMap(String.class);
requestsMap.put("enabled", requestsEnabled);
specimensMap.put("requests", requestsMap);
Expand Down
12 changes: 6 additions & 6 deletions study/test/src/org/labkey/test/tests/study/StudyDataspaceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@
*/
package org.labkey.test.tests.study;

import org.apache.commons.collections4.Bag;
import org.apache.commons.collections4.bag.HashBag;
import org.apache.commons.collections4.MultiSet;
import org.apache.commons.collections4.multiset.HashMultiSet;
import org.apache.commons.lang3.tuple.Pair;
import org.junit.Assert;
import org.junit.experimental.categories.Category;
Expand Down Expand Up @@ -346,14 +346,14 @@ private void verifyVisitTags()
"1/3 - Heterologous boost regimen", "2/4 - Heterologous boost regimen",
"2/4 - Heterologous boost regimen", "1/3 - Heterologous boost regimen");

Bag<List<String>> expectedRows = new HashBag<>(DataRegionTable.collateColumnsIntoRows(VISIT_TAG_MAP_TAGS, VISIT_TAG_MAP_VISITS, VISIT_TAG_MAP_COHORTS));
MultiSet<List<String>> expectedRows = new HashMultiSet<>(DataRegionTable.collateColumnsIntoRows(VISIT_TAG_MAP_TAGS, VISIT_TAG_MAP_VISITS, VISIT_TAG_MAP_COHORTS));

// Check visit tags
clickProject(getProjectName());
goToModule("Query");
viewQueryData("study", "VisitTagMap");
DataRegionTable visitTagMaps = new DataRegionTable("query", this);
Bag<List<String>> actualRows = new HashBag<>(visitTagMaps.getRows("VisitTag", "Visit", "Cohort"));
MultiSet<List<String>> actualRows = new HashMultiSet<>(visitTagMaps.getRows("VisitTag", "Visit", "Cohort"));

assertEquals("Wrong Rows", expectedRows, actualRows);

Expand All @@ -364,13 +364,13 @@ private void verifyVisitTags()
final List<String> STUDY5_VISIT_TAG_MAP_TAGS = Arrays.asList("First Vaccination", "Second Vaccination", "Follow Up", "Follow Up");
final List<String> STUDY5_VISIT_TAG_MAP_VISITS = Arrays.asList("Day -1001", "Day -1316", "Day -1351", "Day -1377");
final List<String> STUDY5_VISIT_TAG_MAP_COHORTS = Arrays.asList(" ", " ", " ", " ");
expectedRows = new HashBag<>(DataRegionTable.collateColumnsIntoRows(STUDY5_VISIT_TAG_MAP_TAGS, STUDY5_VISIT_TAG_MAP_VISITS, STUDY5_VISIT_TAG_MAP_COHORTS));
expectedRows = new HashMultiSet<>(DataRegionTable.collateColumnsIntoRows(STUDY5_VISIT_TAG_MAP_TAGS, STUDY5_VISIT_TAG_MAP_VISITS, STUDY5_VISIT_TAG_MAP_COHORTS));

clickFolder(FOLDER_STUDY5);
goToModule("Query");
viewQueryData("study", "VisitTagMap");
visitTagMaps = new DataRegionTable("query", this);
actualRows = new HashBag<>(visitTagMaps.getRows("VisitTag", "Visit", "Cohort"));
actualRows = new HashMultiSet<>(visitTagMaps.getRows("VisitTag", "Visit", "Cohort"));

assertEquals("Wrong Visit Tag Map Rows in study folder", expectedRows, actualRows);

Expand Down
Loading