From 59ae7418f747db484e08ddd70d11e71d66ef5db0 Mon Sep 17 00:00:00 2001 From: Adam Rauch Date: Tue, 28 Jul 2026 10:43:44 -0700 Subject: [PATCH 1/2] Use report-to exclusively in CSPs --- .../src/org/labkey/embedded/LabKeyServer.java | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/server/embedded/src/org/labkey/embedded/LabKeyServer.java b/server/embedded/src/org/labkey/embedded/LabKeyServer.java index 1c49bcd268..8d0ea1c090 100644 --- a/server/embedded/src/org/labkey/embedded/LabKeyServer.java +++ b/server/embedded/src/org/labkey/embedded/LabKeyServer.java @@ -94,18 +94,19 @@ public static void main(String[] args) script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ${SCRIPT.SOURCES} ; base-uri 'self' ; frame-src 'self' ${FRAME.SOURCES} ; - report-uri ${context.contextPath:}/admin-contentSecurityPolicyReport.api ; + report-to csp-report ; """; + int cspVersion = 17; // Add upgrade_insecure_requests substitution, frame-ancestors, and enforce version String enforceCsp = baseCsp + """ ${UPGRADE.INSECURE.REQUESTS} frame-ancestors 'self' ${FRAMEANCESTORS.SOURCES} ; - /* cspVersion=e16 */ - """; + /* cspVersion=e%d */ + """.formatted(cspVersion); // Leave out upgrade_insecure_requests and frame-ancestors directives, since they produce warnings on some browsers String reportCsp = baseCsp + """ - /* cspVersion=r16 */ - """; + /* cspVersion=r%d */ + """.formatted(cspVersion); application.setDefaultProperties(new HashMap<>() {{ From d2a7f2ad9a55fcc2618ccf4a4db863c045d020fc Mon Sep 17 00:00:00 2001 From: Adam Rauch Date: Tue, 28 Jul 2026 15:02:47 -0700 Subject: [PATCH 2/2] Let's not over-complicate version handling --- .../embedded/src/org/labkey/embedded/LabKeyServer.java | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/server/embedded/src/org/labkey/embedded/LabKeyServer.java b/server/embedded/src/org/labkey/embedded/LabKeyServer.java index 8d0ea1c090..1062e4aae5 100644 --- a/server/embedded/src/org/labkey/embedded/LabKeyServer.java +++ b/server/embedded/src/org/labkey/embedded/LabKeyServer.java @@ -96,17 +96,16 @@ public static void main(String[] args) frame-src 'self' ${FRAME.SOURCES} ; report-to csp-report ; """; - int cspVersion = 17; // Add upgrade_insecure_requests substitution, frame-ancestors, and enforce version String enforceCsp = baseCsp + """ ${UPGRADE.INSECURE.REQUESTS} frame-ancestors 'self' ${FRAMEANCESTORS.SOURCES} ; - /* cspVersion=e%d */ - """.formatted(cspVersion); + /* cspVersion=e17 */ + """; // Leave out upgrade_insecure_requests and frame-ancestors directives, since they produce warnings on some browsers String reportCsp = baseCsp + """ - /* cspVersion=r%d */ - """.formatted(cspVersion); + /* cspVersion=r17 */ + """; application.setDefaultProperties(new HashMap<>() {{