tests(smoke): verify CSP violations caused by lighthouse #12391
Conversation
| }, | ||
| SourceMaps: [{ | ||
| // TODO: Fix frame-src violation when using iframe fetcher. | ||
| // Doesn't trigger a CSP violation because iframe is injected after InspectorIssues gatherer finishes. |
There was a problem hiding this comment.
Could we move InspectorIssues earlier in the config so CSP violations caused by Lighthouse aren't in the report.
Conversely, we could move InspectorIssues to the end so it catches issues caused by SourceMaps.
There was a problem hiding this comment.
Would that even work since InspectorIssues stops listening in afterPass, and some (all?) of these issues come from snapshot?
... so it catches issues caused by SourceMaps.
nbd if this is just the iframe fetcher, which will be removed soon.
There was a problem hiding this comment.
Would that even work since InspectorIssues stops listening in afterPass, and some (all?) of these issues come from snapshot?
In current LH flow, snapshot isn't a special phase it's just immediately called by the afterPass. You have an astute observation though that in FR this isn't actually a problem because snapshot is always called after afterTimespan ;)
lighthouse-cli/test/smokehouse/test-definitions/csp/csp-expectations.js
Outdated
Show resolved
Hide resolved
| }, | ||
| SourceMaps: [{ | ||
| // TODO: Fix frame-src violation when using iframe fetcher. | ||
| // Doesn't trigger a CSP violation because iframe is injected after InspectorIssues gatherer finishes. |
There was a problem hiding this comment.
Would that even work since InspectorIssues stops listening in afterPass, and some (all?) of these issues come from snapshot?
In current LH flow, snapshot isn't a special phase it's just immediately called by the afterPass. You have an astute observation though that in FR this isn't actually a problem because snapshot is always called after afterTimespan ;)
| const blockAllExceptInlineScriptCsp = headersParam([[ | ||
| 'Content-Security-Policy', | ||
| 'default-src \'none\'; script-src \'unsafe-inline\'', | ||
| `default-src 'none'; script-src 'sha256-qZLV55/xxILbIrha9pgX0OdkZMhOlaIgfpEo/6Dly2U='`, |
There was a problem hiding this comment.
Please provide instructions on how to generate this hash. Or, generate it dynamically based on csp.html.
There was a problem hiding this comment.
I added instructions. We could also use a hardcoded "nonce" for this test case.
| // https://github.com/GoogleChrome/lighthouse/pull/12044#issuecomment-788274938 | ||
| // | ||
| // Fixed with new fetcher using M92. | ||
| _maxChromiumMilestone: 91, |
There was a problem hiding this comment.
With the new fetcher, we have our first fixed case 🎉 !
Part of #12378