CSP prohibits custom icons specified as external URLs

[uhafner]

The warnings plugin has a feature, that lets pipeline users or freestyle job owners to specify a custom icon for any of the created Actions that are shown in the side bar. This icon can be a symbol, an icon of the warnings plugin, an icon in Jenkins public web folder, or a remote URL.

(See

warnings-ng-plugin/plugin/src/test/java/io/jenkins/plugins/analysis/warnings/steps/StepsITest.java

Line 598 in 3eb0146

void shouldReportResultWithDifferentIdNameAndIconInStep(final String fileName) {

)

When the icon is set to an external url, e.g. https://raw.githubusercontent.com/pmd/pmd/master/docs/images/logo/PMD_small.svg, then the icon is not rendered anymore.

@daniel-beck can you have a look at it?

[daniel-beck]

I'll take a look soon.

Meanwhile, users encountering problems with external icons can allow the domain(s) in question as img-src using https://plugins.jenkins.io/csp/

[KalleOlaviNiemitalo]

Is there any security concern about a repository owner being able to edit Jenkinsfile to add image URIs, versus a Jenkins instance administrator being able to edit the Content-Security-Policy? I mean, is there a scenario in which the Jenkins instance administrator would like to prevent repository owners from adding images from unapproved sites? … I guess it could happen if the Jenkins instance administrator is responsible of ensuring that IP addresses of Jenkins users are not sent to sites that are not bound to the privacy policy of the Jenkins instance.

[daniel-beck]

I guess it could happen if the Jenkins instance administrator is responsible

Basically that.

A similar issue applies to Badge plugin: jenkinsci/badge-plugin#316

I am currently undecided whether this sort of content moderation should be a (secondary) goal of CSP, or whether anything resembling a legitimate source should be allowed. Users commonly delegate pipeline configuration to Jenkinsfiles already after all, and custom-folder-icon etc. already integrate with this system.

Given https://plugins.jenkins.io/csp allows admins to reset the img-src and manually allowlist domains, that seems like the preferable way to exert control like that, so I'm tentatively thinking that at least img-src should allow URLs from configuration (including Jenkinsfile) automatically.