How to handle `unsafe-eval` using bitbucket static sites - bitbucket

I coded a static page using gatsby and deployed it. :80 is no problem, also when i hosted it on a github static page the console didnt spammed errors.
For each <GatsbyImage/> i am using in my project, i get this chrome-console-error on my static page.
[Report Only] Refused to connect to '<URL>' because it violates the following Content Security Policy directive:
"connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net analytics.atlassian.com as.atlassian.com
api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io
xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net sentry.io bqlf8qjztdtr.statuspage.io <URL>".
Can someone point me to 1. understand the problem 2. handle it properly to avoid all this console errors. i hate errors in live projects ;-)

This is an issue on Content Security Policy usage on Gatsby. See more explanation on [1]. Gatsby cannot be used with a CSP rule directly.
For that there are some plugins, for example one at [2] that make it happen that CSP rule is partially generated by Gatsby. The errors get fixed.
Source:
[1] https://github.com/gatsbyjs/gatsby/issues/10890
[2] https://www.gatsbyjs.com/plugins/gatsby-plugin-csp/

Related

Kentico MVC - PageBuilder Error on external Staging site

Am using Kentico MVC v12 Service Pack.
Have enabled Preview feature and PageBuilder in Application_Start.
When running from localhost, can successfully edit relevant pages using PageBuilder as required.
However, when ran from a staging site, which is a clone of the localhost version, I am getting an error in the Site settings when I try to add a Presentation Url (I am definitely adding in a valid format with the starting "https://" included), which is required for the PageBuilder to be used in the Pages application, where I see this error:
An unexpected error occurred, see event log for more details. Event source: PageEdit, Event code PreviewLinkGeneration
Any assistance would be much appreciated.
Thanks.
Sites error
That error is basically only looking at the string of the URL (almost like a simple validation). Are you sure there is no whitespace before the value you entered in? I can re-create your issue if I type in a space character before the URL.
You can also try clearing the field and saving the form. Then re-enter a value.
If it is still not working, try re-signing all your macros in the system as I have seen the regular expression validation rules have issues if macros aren't working. Which is really what this check is:

Issue trying to launch sample project che-ide-server-extension

With Eclipse Che, I've recently been able to deploy the docker container without any issue as provided in the instructions.
I'm at the point where am trying to learn a bit more about extension development for Che, and I'm going through the small introduction on "developing your first plugin" located on the following page:
https://www.eclipse.org/che/docs/che-in-che-quickstart.html
I'm stuck at the point where I can successfully build and deploy the sample project by executing the Traefik Start, Tomcat8-IDE Start, Deploy IDE and Deploy Workspace Agent commands.
But when it comes time to navigate to the newly created 2nd workspace by clicking on the link provided in the IDE to go to the newly created 2nd workplace instance...:
... I end up getting redirected to the following error page:
I suspect that there may be some kind of configuration problem with the sample plugin project, or configuration problem with keycloak, but I'm at the point where I don't really know how to proceed in terms of troubleshooting.
(Update: 2018/07/31)
At request of #kalrsson for more information, below is a screenshot of the che-public client configuration in my Keycloak instance.
(SOLUTION Update: 2018/08/01)
Thanks to #kalrsson for pointing me in the right direction.
At first I tried only adding the needed URL to the "Valid Redirect URIs" list. Doing so allowed me to get past the issue were I was receiving the error "Invalid parameter: redirect_uri". However, this only presented me with a blank page. On this blank page, when I inspect the web browser console, I noticed the following error:
From there, I also tried to add the needed URL to WebOrigins in KeyCloak as seen below.
Doing this finally allowed me to fully load and render the secondary workspace
Can you go to keycloak_ip:5050/auth, login as admin/admin, clients, che-public, and the IP you use to redirect urls and webOrigins?
So, you need to previewURL:port both to redirectURIs and webOrigins

grails: get redirect loop when deploying to Jetty server, but works fine using Jetty in development mode

NOTE: I put a bounty on this question. I was not able to put a bounty yet on a similar BUT SIMPLER question, here. It is fine if you can help with this simpler question, and then we can put the answer on this one too. In the simpler question you can create the scenario yourself quite quickly. And I also downloaded Jetty 9.1.0 -- so I don't care if it works with 9.05 or 9.10, either version is fine.
I installed Spring Security Core to get the "channel security" feature, namely to indicate which controller actions require an ssl connection.
This works fine in development mode using a Jetty server -- e.g. /cert/page1 defined at bottom, it asks to approve an https connection as expected.
When I deploy the (production) WAR file to Jetty 9 server (hosted externally), I get a redirect loop indication when I go to the same controller/action (using Chrome), or then on Firefox it also indicates "page isn't redirecting properly". I cleared cookies in Chrome just in case, and same problem.
I created an SSL certificate for the Jetty 9 server following directions (using external cert agency) and to install it I looked at various ssl articles on Jetty, and then found it appears simplest to alter the start.ini file, which I did, uncommenting the following lines and pointing to my sslcert/keystore:
#===========================================================
# SSL Context
# Create the keystore and trust store for use by
# HTTPS and SPDY
#-----------------------------------------------------------
jetty.keystore=sslcert/keystore
jetty.keystore.password=xxxxx
jetty.keymanager.password=xxxxx
jetty.truststore=sslcert/keystore
jetty.truststore.password=xxxxx
jetty.secure.port=8443
etc/jetty-ssl.xml
#===========================================================
# HTTPS Connector
# Must be used with jetty-ssl.xml
#-----------------------------------------------------------
jetty.https.port=8443
etc/jetty-https.xml
Is there a general way I can tell if Jetty will take any https page request? In it's log it seems to come up okay from what I did, namely:
2013-10-04 20:48:43.520:INFO:oejs.ServerConnector:main: Started ServerConnector#73c87405{HTTP/1.1}{0.0.0.0:80}
2013-10-04 20:48:43.692:INFO:oejs.ServerConnector:main: Started ServerConnector#4194f034{SSL-http/1.1}{0.0.0.0:8443}
Also, for the my Config.groovy defining the secure channels I have:
grails.plugins.springsecurity.secureChannel.definition = [
'/cert/cpnimember': 'REQUIRES_INSECURE_CHANNEL',
'/cert/page1': 'REQUIRES_SECURE_CHANNEL',
'/cert/page2': 'REQUIRES_SECURE_CHANNEL',
'/cert/page3': 'REQUIRES_SECURE_CHANNEL',
'/cert/page4': 'REQUIRES_INSECURE_CHANNEL'
]
I'm not sure how to debug this. I'd like to go to some page on my jetty 9 server that requires https/ssl just to make sure that it works without the spring-security core defined channels, but don't know what that is.
Can you provide help on how to debug this or what is wrong?
Thanks.
This question is a similar answer to the simplified question I created and offered a bounty. Now that the other question's bounty is awarded I can remove this question. BUT, it is not letting me remove or delete it, so ...
It seems to me that Jetty is redirecting an anonymous request to be logged in (authenticated) to some login screen. Does a login screen exist?

Why am I getting the message "The specified request cannot be executed from current Application Pool"?

Quite not sure why I see this error.
I navigate to my Login View like so http://test.staging.com/mywebsite/Login
My Login view was just redone using MVC but I have seen this same error message going to an aspx page as well...
If I use http I get the error message The specified request cannot be executed from current Application Pool.
If I use https://test.staging.com/mywebsite/Login, I'm good.
If I don't specify a protocol, test.staging.com/mywebsite/Login, I get the error as well
Is there an error happening under the covers and my custom error page can't be shown like discussed here?
What are some other causes of this error?
That usually means your custom errors are configured to run as a different AppPool.
You can read more at MSDN. (See section "Using Custom Errors from Another Application Pool").
There are two ways to correct this behavior. The first is possibly not one that you are interested in because it would require you to change your current architecture and run both sites in the same application pool (such as share the same worker process memory space). To do this, simply move the /errors virtual directory to run in the same application pool as the site for which it serves the custom error.
The second way is to make use of a registry key provided by IIS 6.0. This registry key makes sure IIS 6.0 does not check the metadata during the execution of the custom error and therefore allowing this to work.
See the article for information on the registry key fix.
It may also mean that you are using something along the lines of Server.Transfer to a page that is in a different AppPool.
It could be because you're using different versions of ASP.NET for one or many apps in the pool.
Make sure all apps in the pool use the same version of ASP (e.g. ASP 2.0.50727)
If you just added a new app, try changing the app momentarily to a different version of ASP, then back to same version. I experienced an issue where the displayed version was correct, but under the hood, a different version was used!
Check your event log, under Application, to get more details about the error.
The message would be caused by your page server-side redirecting to a page served by another application pool. Such as for example, in your link, the error page.
I know this is an old thread, but I stumbled upon it and found a different solution. Here's what worked for me: Make sure your application handles .asmx files correctly
From IIS:
Right Click on your project > Properties > Configuration
If necessary, add the .asmx file extension that maps to the aspnet_isapi.dll
Limit to: "GET,HEAD,POST,DEBUG" and restart.
Because I can't comment on vcsjones's answer, I'll add it down here. The DWORD value IgnoreAppPoolForCustomErrors needs to be set under HKLM\SYSTEM\CurrentControlSet\Services\W3SVC\ Parameters vs HKLM\SYSTEM\CurrentControlSet\Services\W3SVC referenced in that technet article. Set it to 1 and do an iisreset and you're good to go.
Source Blog Post
In my particular case, I received this error while trying to serve a content (non ASP.NET) website while it was an Application. Right-Clicking the virtual folder and removing the application fixed it for me.
In my case the application used the application pool that didn't exist. I have no idea how it's happened.

ArgumentNullException when initializing site

I am in the process of evaluating several service frameworks and one of them is OpenRasta.
Despite being taken a bit aback for the lack of organization (multiple source code repositories, lack of binary downloads, outdated build instructions and the end result of the build, OpenRasta.dll, has version 0.0.0.0 after building the openrasta-core repository), I managed my way to start building a site with a service that serves a bit of Xml (I did include OpenRasta.Hosting.AspNet and configured the handlers and modules as per IIS or Cassini).
But the very first time I hit the site (both IIS Express and VS Dev Server) I get a ArgumentNullException coming from the PipelineStage.cs. Apparently the pipeline.CallGraph property is null.
My configuration source is a mere:
ResourceSpace.Has
.ResourcesOfType<CatalogCollection>()
.AtUri("/catalogs")
.HandledBy<CatalogsHandler>()
.AsXmlDataContract();
As I mentioned I am using the code I cloned from the openrasta-core repository as of yesterday.
Thanks in advance
try wrapping resource registrations in
using (OpenRastaConfiguration.Manual)
{
//code
}
Also check this out;
https://github.com/openrasta/openrasta-stable/wiki/Building-Your-First-OpenRasta-Website
Hope this helps

Resources