Timeline report not rendering in Jenkins HTML report without loosening CSP even more

[ismail-s]

Scenario

1. Run Karate tests in Jenkins.
2. In the Jenkins build, save the Karate report in Jenkins using the HTML publisher plugin. ie have something like this in the Jenkinsfile:

publishHTML (target : [allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'target/karate-reports',
reportFiles: '*.html',
reportName: 'Karate Report',
reportTitles: 'Karate Report'])

3. Look at the timeline report in Jenkins

Expected

Timeline report is displayed correctly

Actual

A mostly blank page is displayed:

Further info/discussion

What's happening is that Jenkins sends a content security policy header. We've actually previously loosened this to show the HTML reports, by setting the CSP header to default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' data:;.

However, I've noticed that this isn't working for karate-timeline.html , as that references vis.min.js & vis.min.css from a CDN:

karate/karate-core/src/main/java/com/intuit/karate/report/karate-timeline.html

Lines 11 to 12 in 5050e30

	<script src="https://cdnjs.cloudflare.com/ajax/libs/vis/4.21.0/vis.min.js"></script>
	<link href="https://cdnjs.cloudflare.com/ajax/libs/vis/4.21.0/vis.min.css" rel="stylesheet" type="text/css" />

Contrast this to karate-feature.html , which does this

karate/karate-core/src/main/java/com/intuit/karate/report/karate-feature.html

Lines 9 to 11 in 5050e30

	<script type="text/javascript" src="res/jquery.min.js"></script>
	<script type="text/javascript" src="res/jquery.tablesorter.min.js"></script>
	<script type="text/javascript" src="res/bootstrap.min.js"></script>

We could loosen our CSP even more to allow stuff from https://cdnjs.cloudflare.com, but I think it would make more sense to not fetch the vis dependency from a CDN in the first place, and to add it to this repo like is done for other deps like jquery & bootstrap. Was there a reason why this wasn't done at the time, or couldn't be done?

Thanks in advance,
Ismail

[ptrthomas]

@ismail-s no particular reason. see if you can contribute a PR to expedite

[ismail-s]

Thanks very much.

[ptrthomas]

@ismail-s thank you for the PR. I'll keep this open and close it when we release 1.2.0 final (process we follow)

[ptrthomas]

@ismail-s we actually release 1.2.0.RC4 today, so you will be able to use it from maven etc. let me know if it works ok

[ismail-s]

@ptrthomas Thanks. I've given it a try and the timeline report is now rending correctly.

[ptrthomas]

1.2.0 released