feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chargome merged 9 commits into from
Aug 14, 2024
Merged

feat: Add options for passing nonces to feedback integration #13347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
83afd3e
test: add integration test that uses csp
chargome Aug 6, 2024
9f54dbb
feat: add nonce to replay integration
chargome Aug 6, 2024
f6e5496
feat: pass nonces to feedback directly
chargome Aug 6, 2024
275b9dc
feat: Add nonce to feedback related style tags
chargome Aug 13, 2024
9fe2cd5
fix: set nonce with method
chargome Aug 13, 2024
9f1b5c8
test: update feeedback browser integration test
chargome Aug 13, 2024
8603296
feat: add script nonce for async integration
chargome Aug 13, 2024
3122bec
Merge branch 'develop' into cg/csp-nonce
chargome Aug 13, 2024
e09a904
Merge branch 'develop' into cg/csp-nonce
chargome Aug 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
dsn: 'https://public@dsn.ingest.sentry.io/1337',
integrations: [
feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
],
});

document.addEventListener('securitypolicyviolation', () => {
const container = document.querySelector('#csp-violation');
if (container) {
container.innerText = 'CSP Violation';
}
});
13 changes: 13 additions & 0 deletions dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
<head>
<meta charset="utf-8" />
<meta
http-equiv="Content-Security-Policy"
content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
/>
</head>
<body>
<div id="csp-violation" />
</body>
</html>
84 changes: 84 additions & 0 deletions dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
if (shouldSkipFeedbackTest()) {
sentryTest.skip();
}

const feedbackRequestPromise = page.waitForResponse(res => {
const req = res.request();

const postData = req.postData();
if (!postData) {
return false;
}

try {
return getEnvelopeType(req) === 'feedback';
} catch (err) {
return false;
}
});

await page.route('https://dsn.ingest.sentry.io/**/*', route => {
return route.fulfill({
status: 200,
contentType: 'application/json',
body: JSON.stringify({ id: 'test-id' }),
});
});

const url = await getLocalTestUrl({ testDir: __dirname });

await page.goto(url);
await page.getByText('Report a Bug').click();
expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
await page.locator('[name="name"]').fill('Jane Doe');
await page.locator('[name="email"]').fill('janedoe@example.org');
await page.locator('[name="message"]').fill('my example feedback');
await page.locator('[data-sentry-feedback] .btn--primary').click();

const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
expect(feedbackEvent).toEqual({
type: 'feedback',
breadcrumbs: expect.any(Array),
contexts: {
feedback: {
contact_email: 'janedoe@example.org',
message: 'my example feedback',
name: 'Jane Doe',
source: 'widget',
url: `${TEST_HOST}/index.html`,
},
trace: {
trace_id: expect.stringMatching(/\w{32}/),
span_id: expect.stringMatching(/\w{16}/),
},
},
level: 'info',
tags: {
from: 'integration init',
},
timestamp: expect.any(Number),
event_id: expect.stringMatching(/\w{32}/),
environment: 'production',
sdk: {
integrations: expect.arrayContaining(['Feedback']),
version: expect.any(String),
name: 'sentry.javascript.browser',
packages: expect.anything(),
},
request: {
url: `${TEST_HOST}/index.html`,
headers: {
'User-Agent': expect.stringContaining(''),
},
},
platform: 'javascript',
});
const cspContainer = await page.locator('#csp-violation');
expect(cspContainer).not.toContainText('CSP Violation');
});
9 changes: 8 additions & 1 deletion packages/browser/src/utils/lazyLoadIntegration.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
* Lazy load an integration from the CDN.
* Rejects if the integration cannot be loaded.
*/
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
name: keyof typeof LazyLoadableIntegrations,
scriptNonce?: string,
): Promise<IntegrationFn> {
const bundle = LazyLoadableIntegrations[name];

// `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
script.crossOrigin = 'anonymous';
script.referrerPolicy = 'origin';

if (scriptNonce) {
script.setAttribute('nonce', scriptNonce);
}

const waitForLoad = new Promise<void>((resolve, reject) => {
script.addEventListener('load', () => resolve());
script.addEventListener('error', reject);
Expand Down
6 changes: 5 additions & 1 deletion packages/feedback/src/core/components/Actor.css.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
* Creates <style> element for widget actor (button that opens the dialog)
*/
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
const style = DOCUMENT.createElement('style');
style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

if (styleNonce) {
style.setAttribute('nonce', styleNonce);
}

return style;
}
5 changes: 3 additions & 2 deletions packages/feedback/src/core/components/Actor.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
triggerLabel: string;
triggerAriaLabel: string;
shadow: ShadowRoot;
styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
* The sentry-provided button to open the feedback modal
*/
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
const el = DOCUMENT.createElement('button');
el.type = 'button';
el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
el.appendChild(label);
}

const style = createActorStyles();
const style = createActorStyles(styleNonce);

return {
el,
Expand Down
11 changes: 10 additions & 1 deletion packages/feedback/src/core/createMainStyles.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
* Creates <style> element for widget actor (button that opens the dialog)
*/
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
colorScheme,
themeDark,
themeLight,
styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
const style = DOCUMENT.createElement('style');
style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

if (styleNonce) {
style.setAttribute('nonce', styleNonce);
}

return style;
}
12 changes: 10 additions & 2 deletions packages/feedback/src/core/integration.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
// The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
// dependency with @sentry/core
lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
lazyLoadIntegration: (
name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
scriptNonce?: string,
) => Promise<IntegrationFn>;
getModalIntegration?: null | (() => IntegrationFn);
getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
name: 'username',
},
tags,
styleNonce,
scriptNonce,

// FeedbackThemeConfiguration
colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
enableScreenshot,
useSentryUser,
tags,
styleNonce,
scriptNonce,

colorScheme,
themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
if (existing) {
return existing as I;
}
const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
const integration = integrationFn();
client && client.addIntegration(integration);
return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
triggerLabel: mergedOptions.triggerLabel,
triggerAriaLabel: mergedOptions.triggerAriaLabel,
shadow,
styleNonce,
});
_attachTo(actor.el, {
...mergedOptions,
Expand Down
6 changes: 5 additions & 1 deletion packages/feedback/src/modal/components/Dialog.css.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
* Creates <style> element for widget dialog
*/
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
const style = DOCUMENT.createElement('style');

style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

if (styleNonce) {
style.setAttribute('nonce', styleNonce);
}

return style;
}
2 changes: 1 addition & 1 deletion packages/feedback/src/modal/integration.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
const user = getUser();

const el = DOCUMENT.createElement('div');
const style = createDialogStyles();
const style = createDialogStyles(options.styleNonce);

let originalOverflow = '';
const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down
4 changes: 2 additions & 2 deletions packages/feedback/src/screenshot/components/ScreenshotEditor.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

return function ScreenshotEditor({ onError }: Props): VNode {
const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
const CropCorner = CropCornerFactory({ h });

const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

return (
<div class="editor">
<style dangerouslySetInnerHTML={styles} />
<style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
<div class="editor__canvas-container" ref={canvasContainerRef}>
<div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
<canvas
Expand Down
6 changes: 5 additions & 1 deletion packages/feedback/src/screenshot/components/ScreenshotInput.css.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
* Creates <style> element for widget dialog
*/
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
const style = DOCUMENT.createElement('style');

const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

if (styleNonce) {
style.setAttribute('nonce', styleNonce);
}

return style;
}
10 changes: 10 additions & 0 deletions packages/types/src/feedback/config.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
* Set an object that will be merged sent as tags data with the event.
*/
tags?: { [key: string]: Primitive };

/**
* Set a nonce to be passed to the injected <style> tag for enforcing CSP
*/
styleNonce?: string;

/**
* Set a nonce to be passed to the injected <script> tag for enforcing CSP
*/
scriptNonce?: string;
}

/**
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat: Add options for passing nonces to feedback integration#13347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

chargome
merged 9 commits into

from

Aug 14, 2024
 Merged


feat: Add options for passing nonces to feedback integration
#13347
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
83afd3e

test: add integration test that uses csp


chargome Aug 6, 2024
9f54dbb

feat: add nonce to replay integration


chargome Aug 6, 2024
f6e5496

feat: pass nonces to feedback directly


chargome Aug 6, 2024
275b9dc

feat: Add nonce to feedback related style tags


chargome Aug 13, 2024
9fe2cd5

fix: set nonce with method


chargome Aug 13, 2024
9f1b5c8

test: update feeedback browser integration test


chargome Aug 13, 2024
8603296

feat: add script nonce for async integration


chargome Aug 13, 2024
3122bec

Merge branch 'develop' into cg/csp-nonce


chargome Aug 13, 2024
e09a904

Merge branch 'develop' into cg/csp-nonce


chargome Aug 14, 2024

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 19 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/init.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
import * as Sentry from '@sentry/browser';
// Import this separately so that generatePlugin can handle it for CDN scenarios
import { feedbackIntegration } from '@sentry/browser';

window.Sentry = Sentry;

Sentry.init({
 dsn: 'https://public@dsn.ingest.sentry.io/1337',
 integrations: [
 feedbackIntegration({ tags: { from: 'integration init' }, styleNonce: 'foo1234', scriptNonce: 'foo1234' }),
 ],
});

document.addEventListener('securitypolicyviolation', () => {
 const container = document.querySelector('#csp-violation');
 if (container) {
 container.innerText = 'CSP Violation';
 }
});

13 changes: 13 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/template.html

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html>
 <head>
 <meta charset="utf-8" />
 <meta
 http-equiv="Content-Security-Policy"
 content="style-src 'nonce-foo1234'; script-src sentry-test.io 'nonce-foo1234';"
 />
 </head>
 <body>
 <div id="csp-violation" />
 </body>
</html>

84 changes: 84 additions & 0 deletions
dev-packages/browser-integration-tests/suites/feedback/captureFeedbackCsp/test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
import { expect } from '@playwright/test';

import { TEST_HOST, sentryTest } from '../../../utils/fixtures';
import { envelopeRequestParser, getEnvelopeType, shouldSkipFeedbackTest } from '../../../utils/helpers';

sentryTest('should capture feedback', async ({ getLocalTestUrl, page }) => {
 if (shouldSkipFeedbackTest()) {
 sentryTest.skip();
 }

 const feedbackRequestPromise = page.waitForResponse(res => {
 const req = res.request();

 const postData = req.postData();
 if (!postData) {
 return false;
 }

 try {
 return getEnvelopeType(req) === 'feedback';
 } catch (err) {
 return false;
 }
 });

 await page.route('https://dsn.ingest.sentry.io/**/*', route => {
 return route.fulfill({
 status: 200,
 contentType: 'application/json',
 body: JSON.stringify({ id: 'test-id' }),
 });
 });

 const url = await getLocalTestUrl({ testDir: __dirname });

 await page.goto(url);
 await page.getByText('Report a Bug').click();
 expect(await page.locator(':visible:text-is("Report a Bug")').count()).toEqual(1);
 await page.locator('[name="name"]').fill('Jane Doe');
 await page.locator('[name="email"]').fill('janedoe@example.org');
 await page.locator('[name="message"]').fill('my example feedback');
 await page.locator('[data-sentry-feedback] .btn--primary').click();

 const feedbackEvent = envelopeRequestParser((await feedbackRequestPromise).request());
 expect(feedbackEvent).toEqual({
 type: 'feedback',
 breadcrumbs: expect.any(Array),
 contexts: {
 feedback: {
 contact_email: 'janedoe@example.org',
 message: 'my example feedback',
 name: 'Jane Doe',
 source: 'widget',
 url: `${TEST_HOST}/index.html`,
 },
 trace: {
 trace_id: expect.stringMatching(/\w{32}/),
 span_id: expect.stringMatching(/\w{16}/),
 },
 },
 level: 'info',
 tags: {
 from: 'integration init',
 },
 timestamp: expect.any(Number),
 event_id: expect.stringMatching(/\w{32}/),
 environment: 'production',
 sdk: {
 integrations: expect.arrayContaining(['Feedback']),
 version: expect.any(String),
 name: 'sentry.javascript.browser',
 packages: expect.anything(),
 },
 request: {
 url: `${TEST_HOST}/index.html`,
 headers: {
 'User-Agent': expect.stringContaining(''),
 },
 },
 platform: 'javascript',
 });
 const cspContainer = await page.locator('#csp-violation');
 expect(cspContainer).not.toContainText('CSP Violation');
});

9 changes: 8 additions & 1 deletion
packages/browser/src/utils/lazyLoadIntegration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,7 +31,10 @@ const WindowWithMaybeIntegration = WINDOW as {
 * Lazy load an integration from the CDN.
 * Rejects if the integration cannot be loaded.
 */
export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegrations): Promise<IntegrationFn> {
export async function lazyLoadIntegration(
 name: keyof typeof LazyLoadableIntegrations,
 scriptNonce?: string,
): Promise<IntegrationFn> {
 const bundle = LazyLoadableIntegrations[name];

 // `window.Sentry` is only set when using a CDN bundle, but this method can also be used via the NPM package
Expand All@@ -56,6 +59,10 @@ export async function lazyLoadIntegration(name: keyof typeof LazyLoadableIntegra
 script.crossOrigin = 'anonymous';
 script.referrerPolicy = 'origin';

 if (scriptNonce) {
 script.setAttribute('nonce', scriptNonce);
 }

 const waitForLoad = new Promise<void>((resolve, reject) => {
 script.addEventListener('load', () => resolve());
 script.addEventListener('error', reject);
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/core/components/Actor.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createActorStyles(): HTMLStyleElement {
export function createActorStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
.widget__actor {
Expand DownExpand Up@@ -58,5 +58,9 @@ export function createActorStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

5 changes: 3 additions & 2 deletions
packages/feedback/src/core/components/Actor.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ export interface ActorProps {
 triggerLabel: string;
 triggerAriaLabel: string;
 shadow: ShadowRoot;
 styleNonce?: string;
}

export interface ActorComponent {
Expand All@@ -23,7 +24,7 @@ export interface ActorComponent {
/**
 * The sentry-provided button to open the feedback modal
 */
export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): ActorComponent {
export function Actor({ triggerLabel, triggerAriaLabel, shadow, styleNonce }: ActorProps): ActorComponent {
 const el = DOCUMENT.createElement('button');
 el.type = 'button';
 el.className = 'widget__actor';
Expand All@@ -36,7 +37,7 @@ export function Actor({ triggerLabel, triggerAriaLabel, shadow }: ActorProps): A
 el.appendChild(label);
 }

 const style = createActorStyles();
 const style = createActorStyles(styleNonce);

 return {
 el,
Expand Down

11 changes: 10 additions & 1 deletion
packages/feedback/src/core/createMainStyles.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,12 @@ function getThemedCssVariables(theme: InternalTheme): string {
/**
 * Creates <style> element for widget actor (button that opens the dialog)
 */
export function createMainStyles({ colorScheme, themeDark, themeLight }: FeedbackInternalOptions): HTMLStyleElement {
export function createMainStyles({
 colorScheme,
 themeDark,
 themeLight,
 styleNonce,
}: FeedbackInternalOptions): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');
 style.textContent = `
:host {
Expand DownExpand Up@@ -86,5 +91,9 @@ ${
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

12 changes: 10 additions & 2 deletions
packages/feedback/src/core/integration.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,10 @@ type Unsubscribe = () => void;
interface BuilderOptions {
 // The type here should be `keyof typeof LazyLoadableIntegrations`, but that'll cause a cicrular
 // dependency with @sentry/core
 lazyLoadIntegration: (name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration') => Promise<IntegrationFn>;
 lazyLoadIntegration: (
 name: 'feedbackModalIntegration' | 'feedbackScreenshotIntegration',
 scriptNonce?: string,
 ) => Promise<IntegrationFn>;
 getModalIntegration?: null | (() => IntegrationFn);
 getScreenshotIntegration?: null | (() => IntegrationFn);
}
Expand DownExpand Up@@ -77,6 +80,8 @@ export const buildFeedbackIntegration = ({
 name: 'username',
 },
 tags,
 styleNonce,
 scriptNonce,

 // FeedbackThemeConfiguration
 colorScheme = 'system',
Expand DownExpand Up@@ -119,6 +124,8 @@ export const buildFeedbackIntegration = ({
 enableScreenshot,
 useSentryUser,
 tags,
 styleNonce,
 scriptNonce,

 colorScheme,
 themeDark,
Expand DownExpand Up@@ -176,7 +183,7 @@ export const buildFeedbackIntegration = ({
 if (existing) {
 return existing as I;
 }
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName));
 const integrationFn = (getter && getter()) || (await lazyLoadIntegration(functionMethodName, scriptNonce));
 const integration = integrationFn();
 client && client.addIntegration(integration);
 return integration as I;
Expand DownExpand Up@@ -272,6 +279,7 @@ export const buildFeedbackIntegration = ({
 triggerLabel: mergedOptions.triggerLabel,
 triggerAriaLabel: mergedOptions.triggerAriaLabel,
 shadow,
 styleNonce,
 });
 _attachTo(actor.el, {
 ...mergedOptions,
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/modal/components/Dialog.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -273,7 +273,7 @@ const SUCCESS = `
/**
 * Creates <style> element for widget dialog
 */
export function createDialogStyles(): HTMLStyleElement {
export function createDialogStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 style.textContent = `
Expand All@@ -288,5 +288,9 @@ ${BUTTON}
${SUCCESS}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

2 changes: 1 addition & 1 deletion
packages/feedback/src/modal/integration.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,7 @@ export const feedbackModalIntegration = ((): FeedbackModalIntegration => {
 const user = getUser();

 const el = DOCUMENT.createElement('div');
 const style = createDialogStyles();
 const style = createDialogStyles(options.styleNonce);

 let originalOverflow = '';
 const dialog: ReturnType<FeedbackModalIntegration['createDialog']> = {
Expand Down

4 changes: 2 additions & 2 deletions
packages/feedback/src/screenshot/components/ScreenshotEditor.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@ export function ScreenshotEditorFactory({
 const useTakeScreenshot = useTakeScreenshotFactory({ hooks });

 return function ScreenshotEditor({ onError }: Props): VNode {
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles().innerText }), []);
 const styles = hooks.useMemo(() => ({ __html: createScreenshotInputStyles(options.styleNonce).innerText }), []);
 const CropCorner = CropCornerFactory({ h });

 const canvasContainerRef = hooks.useRef<HTMLDivElement>(null);
Expand DownExpand Up@@ -313,7 +313,7 @@ export function ScreenshotEditorFactory({

 return (
 <div class="editor">
 <style dangerouslySetInnerHTML={styles} />
 <style nonce={options.styleNonce} dangerouslySetInnerHTML={styles} />
 <div class="editor__canvas-container" ref={canvasContainerRef}>
 <div class="editor__crop-container" style={{ position: 'absolute', zIndex: 1 }} ref={cropContainerRef}>
 <canvas
Expand Down

6 changes: 5 additions & 1 deletion
packages/feedback/src/screenshot/components/ScreenshotInput.css.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import { DOCUMENT } from '../../constants';
/**
 * Creates <style> element for widget dialog
 */
export function createScreenshotInputStyles(): HTMLStyleElement {
export function createScreenshotInputStyles(styleNonce?: string): HTMLStyleElement {
 const style = DOCUMENT.createElement('style');

 const surface200 = '#1A141F';
Expand DownExpand Up@@ -86,5 +86,9 @@ export function createScreenshotInputStyles(): HTMLStyleElement {
}
`;

 if (styleNonce) {
 style.setAttribute('nonce', styleNonce);
 }

 return style;
}

10 changes: 10 additions & 0 deletions
packages/types/src/feedback/config.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,6 +61,16 @@ export interface FeedbackGeneralConfiguration {
 * Set an object that will be merged sent as tags data with the event.
 */
 tags?: { [key: string]: Primitive };

 /**
 * Set a nonce to be passed to the injected <style> tag for enforcing CSP
 */
 styleNonce?: string;

 /**
 * Set a nonce to be passed to the injected <script> tag for enforcing CSP
 */
 scriptNonce?: string;
}

/**
Expand Down