Stop sending labkeyVersion in our CSPs

[labkey-adam]

Rationale

https://github.com/LabKey/internal-issues/issues/858

Also, support browsers (e.g., Safari) that post individual JSON reports in addition to those (e.g., Chrome) that post an array of JSON reports

[labkey-jeckels]

Testing locally, the CSP doesn't have the version in it anymore, as intended.

However, when I have a CSP violation and it's reported, my local server gives a 400 reply to admin-contentSecurityPolicyReportTo.view?cspVersion=e14:

{
    "exception": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]",
    "success": false,
    "errors": [
        {
            "msg": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]",
            "severity": "Error",
            "field": "form",
            "id": "form",
            "message": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]"
        }
    ]
}

[labkey-jeckels]

Testing locally, the CSP doesn't have the version in it anymore, as intended.

However, when I have a CSP violation and it's reported, my local server gives a 400 reply to admin-contentSecurityPolicyReportTo.view?cspVersion=e14:

{
    "exception": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]",
    "success": false,
    "errors": [
        {
            "msg": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]",
            "severity": "Error",
            "field": "form",
            "id": "form",
            "message": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]"
        }
    ]
}

Chrome seems to work. Safari doesn't, likely predating this change. Here's what it's trying to POST:

{
    "type": "csp-violation",
    "url": "https://jeckels.labkey.com/home/wiki-page.view?name=inlineScript",
    "body": {
        "documentURL": "https://jeckels.labkey.com/home/wiki-page.view?name=inlineScript",
        "disposition": "enforce",
        "referrer": "https://jeckels.labkey.com/home/wiki-page.view?name=default",
        "effectiveDirective": "script-src-attr",
        "blockedURL": "inline",
        "originalPolicy": "default-src 'self' ; connect-src 'self' localhost:3001 ws://localhost:3001 webpack: https://code.jquery.com/ui/1.13.2/jquery-ui.min.js ; object-src 'self' ; style-src 'self' 'unsafe-inline' https://cdn.datatables.net ; img-src 'self' data:  ; font-src 'self' data: localhost:3001 https://mathjax.rstudio.com ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-b070ec06d019473c'  ; base-uri 'self' ; frame-src 'self' https://player.vimeo.com ;  frame-ancestors 'self' ; report-uri /admin-contentSecurityPolicyReport.api?cspVersion=e14 ; report-to csp-enforce ;",
        "statusCode": 200,
        "sample": "",
        "sourceFile": "https://jeckels.labkey.com/home/wiki-page.view?name=inlineScript",
        "lineNumber": 392,
        "columnNumber": 1
    }
}

[labkey-adam]

Testing locally, the CSP doesn't have the version in it anymore, as intended.
However, when I have a CSP violation and it's reported, my local server gives a 400 reply to admin-contentSecurityPolicyReportTo.view?cspVersion=e14:

{
    "exception": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]",
    "success": false,
    "errors": [
        {
            "msg": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]",
            "severity": "Error",
            "field": "form",
            "id": "form",
            "message": "Error binding property: Cannot deserialize value of type `org.labkey.core.admin.AdminController$ReportToJsonObjects` from Object value (token `JsonToken.START_OBJECT`)\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]"
        }
    ]
}

Chrome seems to work. Safari doesn't, likely predating this change. Here's what it's trying to POST:

{
    "type": "csp-violation",
    "url": "https://jeckels.labkey.com/home/wiki-page.view?name=inlineScript",
    "body": {
        "documentURL": "https://jeckels.labkey.com/home/wiki-page.view?name=inlineScript",
        "disposition": "enforce",
        "referrer": "https://jeckels.labkey.com/home/wiki-page.view?name=default",
        "effectiveDirective": "script-src-attr",
        "blockedURL": "inline",
        "originalPolicy": "default-src 'self' ; connect-src 'self' localhost:3001 ws://localhost:3001 webpack: https://code.jquery.com/ui/1.13.2/jquery-ui.min.js ; object-src 'self' ; style-src 'self' 'unsafe-inline' https://cdn.datatables.net ; img-src 'self' data:  ; font-src 'self' data: localhost:3001 https://mathjax.rstudio.com ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-b070ec06d019473c'  ; base-uri 'self' ; frame-src 'self' https://player.vimeo.com ;  frame-ancestors 'self' ; report-uri /admin-contentSecurityPolicyReport.api?cspVersion=e14 ; report-to csp-enforce ;",
        "statusCode": 200,
        "sample": "",
        "sourceFile": "https://jeckels.labkey.com/home/wiki-page.view?name=inlineScript",
        "lineNumber": 392,
        "columnNumber": 1
    }
}

Okay, so Chrome and Firefox always post an array of JSON objects. Apparently Safari posts single objects. That's annoying, but glad you caught it.

[labkey-adam]

@labkey-jeckels can you test this locally against Safari? Current version is no longer supported on Windows.

I did test your JSON example via the query-apiTest action.

[labkey-jeckels]

@labkey-jeckels can you test this locally against Safari? Current version is no longer supported on Windows.

I did test your JSON example via the query-apiTest action.

Confirmed on Safari, Chrome, and Firefox.