CSP: ui:debug doesn't work with CSP turned on

[martin654]

CSP: ui:debug doesn't work with CSP turned on

[melloware]

Unfortunately as you know ui:debug is a JSF component NOT a PF component and it uses JS eval. In all of PrimeFaces code we do this...

PrimeFaces.csp.eval(XXX);

Which allows for eval under CSP. Becuase ui:debug is doing a raw eval you will get this CSP violation. Not sure there is anything PF can fix about this...

[melloware]

both Mojarra and MyFaces do this in UIDebug.java...

sb.append("function faceletsDebug(URL) { day = new Date(); id = day.getTime(); eval(\"page\" + id + \" "
                  + "= window.open(URL, '\" + id + \"', 'toolbar=0,scrollbars=1,location=0,statusbar=0,menubar=0,"
                  + "resizable=1,width=800,height=600,left = 240,top = 212');\"); };");

[martin654]

I understand. Thank you for investigating it.

[melloware]

@martin654 i could add a <pe:debug> to PrimeFaces Extensions which will handle the CSP if you are interested we could open a ticket over at PFE?

[melloware]

for now i will close this as this is an issue in both JSF libs.

[martin654]

@martin654 i could add a <pe:debug> to PrimeFaces Extensions which will handle the CSP if you are interested we could open a ticket over at PFE?

Hi, we use ui:debug sometimes in non-prod environment. We can templorarily disable CSP for this. It isn't a must-have feature for us, but thanks for the offer. Thanks