CSP (content security policy) breaks some sites when they are launched from an existing web page #16251

pitsi · 2021-06-05T11:21:03Z

Description

As mentioned in the title, csp (content security policy) breaks some sites when they are launched from an existing page.
I use a simple page as my new tab and launch the 20+ sites I mostly visit from there. Right now, facebook and cockpit (local page, web console for linux servers) are affected. The error output in brave's console (f12 > console) always looks similar to this

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src *". Either the 'unsafe-inline' keyword, a hash ('sha256-random numbers and letters'), or a nonce ('nonce-...') is required to enable inline execution.

This can also be considered a followup of #13929

Steps to Reproduce

Create a simple web page locally, e.g.

<html>
<head>
<title>a simple page</title>
</head>
<body>
<a href="https://www.facebook.com/">Facebook</a>
<a href="https://192.168.1.5:9090">Cockpit</a>
</body>
</html>

Open it in brave.
Click on any of the 2 links mentioned.
Notice that the pages appear broken.
The errors appear in the console (f12 > console)

Actual result:

Facebook's page appears completely blank. Cockpit's appears like so

Expected result:

I assume everyone knows how facebook's main page looks. Cockpit's should appear like so, prompting the user for credentials.

Reproduces how often:

Easily.

Brave version (brave://version info)

Brave 1.25.68 Chromium: 91.0.4472.77 (Official Build) (64-bit)
Revision 1cecd5c8a856bc2a5adda436e7b84d8d21b339b6-refs/branch-heads/4472@{# 1246}
OS Linux

Version/Channel Information:

Can you reproduce this issue with the current release? Yes
Can you reproduce this issue with the beta channel? Probably
Can you reproduce this issue with the nightly channel? Probably

Other Additional Information:

Does the issue resolve itself when disabling Brave Shields? No
Does the issue resolve itself when disabling Brave Rewards? No
Is the issue reproducible on the latest version of Chrome? No. Tested on chrome unstable, v93.0.4530.5 as of today.

Miscellaneous Information:

In order for facebook to appear blank, the user must be already logged in in facebook. If not, it shows the usual facebook login page but the same errors on the console.

Moreover, if the forementioned link leads to any of facebook's subpages, e.g.

facebook.com/messages
facebook.com/bravesoftware

the page appears blank as well and the same errors appear on the console.

Last but not least, if instead of pressing the link, the user types the url in the address bar, each page opens with no issues and no errors in the console.

The text was updated successfully, but these errors were encountered:

ryanbr · 2021-06-05T12:20:04Z

I think this is related too #16156

pitsi · 2021-06-05T12:25:48Z

Maybe. If the devs judge that the issues are the same, feel free to close this one.
I forgot to mention that it started happening after the upgrade to 1.25.x, so it must have appeared at the same time as yours. However, I noticed the problem on cockpit yesterday, so I decided to investigate it more and then I opened this issue report here.

ryanbr · 2021-06-05T12:53:14Z

Can you check if Chrome is affected? we've had reports Chrome had similar issues. @pitsi

pitsi · 2021-06-05T12:58:15Z

I have chromium and chrome, both on v91.0.4472.77, but on my windows partition. I will later transfer my page there and check.
On linux, as I have mentioned above, chrome unstable (v93.0.4530.5) is not affected.

pitsi · 2021-06-05T13:09:53Z

And no, chromium and chrome from windows are not affected. Both pages load with no issues and no errors in the console.

ask1234560 · 2021-06-05T15:49:30Z

Can confirm. Quora is breaking, if the site is opened in the same tab. But it works when the site is opened in new tab.
Version 1.25.70 Chromium: 91.0.4472.77 (Official Build) (64-bit)

pitsi · 2021-06-05T17:52:57Z

I do not have a quora account, thus I am not logged in to the site. I added it to my simple page, and it opens up as usual, asking for credentials. If you do have an account in quora, can you please check the console for similar errors?

The forementioned sites (facebok and cockpit) cause the issue whether they are lauched on the same tab or in a new one.

---edit
I retried quora just now and indeed it does fail to open, even without credentials. There is just a red Q in the middle of the page and nothing happens. The error in the console is identical to the one mentioned at the top of the issue report.

pitsi · 2021-06-07T18:39:21Z

One very minor discovery I just made. Pressing f5 to refresh that broken page (= any of the pages mentioned above) does not resolve the issue. The same errors appear on the console too.
One has to click in the address bar and press enter, as if he typed the full url in the first place, as a workaround.

ryanbr · 2021-06-08T06:48:13Z

Okay looked into this. Bisected to a

Create a basic .html file
<html><body><a href="https://duckduckgo.com/">Link</a></body></html>
Open html, and click on href link in Brave
Fails from Nightly v1.25.17 onwards.

Nightly v1.25.46   Bad
Nightly v1.25.34   Bad
Nightly v1.25.17   Bad
Nightly v1.25.16   Good
Nightly v1.25.15   Good

v1.25.16...v1.25.17

antonok-edm · 2021-06-08T17:14:02Z

@pitsi @ask1234560 I'm investigating a fix for this; in the meantime you should be able to work around it by disabling #brave-adblock-csp-rules under brave://flags

pitsi · 2021-06-08T18:30:00Z

It worked for me!

ask1234560 · 2021-06-09T13:43:48Z

Thanks @antonok-edm it works for me too.

antonok-edm · 2021-06-10T19:08:50Z

@kjozwiak I added QA/No here since there's already a QA/Yes label on #16283, which is tied to the same PR - feel free to update that if necessary

pitsi · 2021-06-11T16:18:47Z

When 1.27.x reaches stable and this thing is resolved, can someone please post here and let us know to change the flag back?

antonok-edm · 2021-06-11T18:22:16Z

@pitsi This change has been uplifted to the next 1.25.x hotfix release, which is actually scheduled for later today as far as I'm aware.

pitsi · 2021-06-12T03:59:08Z

Thanks! I got the upgrade a few minutes ago, switched #brave-adblock-csp-rules back to default and now works as it should.

pitsi · 2021-09-16T10:41:11Z

Sorry for bringing up a 3 month old issue, but I have to ask before opening a new one. A page I visit shows up blank since the 2 weeks ago and this is what the console says

Access to internal resource at 'https://www.e-shop.gr/site.webmanifest' from origin 'https://e-shop.gr' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Is it the same as above? I do not mean the error, because it obviously isn't, I mean the reason. If it is not the same, I will open a new issue.

ask1234560 · 2021-09-16T16:01:59Z

@pitsi the CORS error is not related to brave. CORS or cross origin request sharing error happens when CORS header is not present usually this is done in the backend.

pitsi added the OS/Desktop label Jun 5, 2021

ryanbr added the regression label Jun 8, 2021

antonok-edm mentioned this issue Jun 9, 2021

Tie CSP rule injection to Shields ads/tracker setting brave/brave-core#9053

Merged

24 tasks

antonok-edm closed this as completed in brave/brave-core#9053 Jun 10, 2021

antonok-edm added this to the 1.27.x - Nightly milestone Jun 10, 2021

This was referenced Jun 10, 2021

Tie CSP rule injection to Shields ads/tracker setting (uplift to 1.26.x) brave/brave-core#9072

Merged

Tie CSP rule injection to Shields ads/tracker setting (uplift to 1.25.x) brave/brave-core#9073

Merged

kjozwiak modified the milestones: 1.27.x - Nightly, 1.25.x - Release #5 Jun 10, 2021

antonok-edm added QA/No QA/Test-Plan-Specified labels Jun 10, 2021

kjozwiak added the release-notes/exclude label Jun 11, 2021

srirambv mentioned this issue Jun 11, 2021

Fix $csp rules being applied even when Shields are down #16283

Closed

pitsi mentioned this issue Sep 9, 2021

Brave crashes when opening the autoplay settings #17808

Closed

androbourne mentioned this issue Oct 31, 2022

CSP (content security policy) Still Preventing Sites from loading #26387

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CSP (content security policy) breaks some sites when they are launched from an existing web page #16251

CSP (content security policy) breaks some sites when they are launched from an existing web page #16251

pitsi commented Jun 5, 2021

ryanbr commented Jun 5, 2021

pitsi commented Jun 5, 2021

ryanbr commented Jun 5, 2021

pitsi commented Jun 5, 2021

pitsi commented Jun 5, 2021

ask1234560 commented Jun 5, 2021 •

edited

Loading

pitsi commented Jun 5, 2021 •

edited

Loading

pitsi commented Jun 7, 2021

ryanbr commented Jun 8, 2021 •

edited

Loading

antonok-edm commented Jun 8, 2021

pitsi commented Jun 8, 2021

ask1234560 commented Jun 9, 2021

antonok-edm commented Jun 10, 2021

pitsi commented Jun 11, 2021

antonok-edm commented Jun 11, 2021

pitsi commented Jun 12, 2021

pitsi commented Sep 16, 2021 •

edited

Loading

ask1234560 commented Sep 16, 2021

CSP (content security policy) breaks some sites when they are launched from an existing web page #16251

CSP (content security policy) breaks some sites when they are launched from an existing web page #16251

Comments

pitsi commented Jun 5, 2021

Description

Steps to Reproduce

Actual result:

Expected result:

Reproduces how often:

Brave version (brave://version info)

Version/Channel Information:

Other Additional Information:

Miscellaneous Information:

ryanbr commented Jun 5, 2021

pitsi commented Jun 5, 2021

ryanbr commented Jun 5, 2021

pitsi commented Jun 5, 2021

pitsi commented Jun 5, 2021

ask1234560 commented Jun 5, 2021 • edited Loading

pitsi commented Jun 5, 2021 • edited Loading

pitsi commented Jun 7, 2021

ryanbr commented Jun 8, 2021 • edited Loading

antonok-edm commented Jun 8, 2021

pitsi commented Jun 8, 2021

ask1234560 commented Jun 9, 2021

antonok-edm commented Jun 10, 2021

pitsi commented Jun 11, 2021

antonok-edm commented Jun 11, 2021

pitsi commented Jun 12, 2021

pitsi commented Sep 16, 2021 • edited Loading

ask1234560 commented Sep 16, 2021

ask1234560 commented Jun 5, 2021 •

edited

Loading

pitsi commented Jun 5, 2021 •

edited

Loading

ryanbr commented Jun 8, 2021 •

edited

Loading

pitsi commented Sep 16, 2021 •

edited

Loading