2.4: Remove frame-ancestors * CSP directive (#4332)
#4550
Conversation
Summary:
Generated with `git restore -s origin/master .travis.yml .github/ ci/`,
plus the following manual changes:
- removed the `build-data-server-pip` CI job, since 2.4 doesn’t have
any Rust packages to build;
- reinstated `flake8` for Python 3.5;
- removed CI check for absence of `"@npm_angular_bazel//:index.bzl"`;
- downgraded CI Bazel to 2.1.0 to match WORKSPACE file;
- cherry-picked `test_pip_package.sh` changes for `--tf-version notf`.
Test Plan:
CI test run passed:
<https://github.com/tensorflow/tensorboard/runs/1699068256>
wchargin-branch: ci-backport-2.4
wchargin-source: a6833768fb4e5c516f426d5c32b4044063fcfefc
This PR essentially reverses #2797. Currently this doesn't work because the `frame-ancestors *` directive prevents VS Code from framing TensorBoard. This is because VS Code is an Electron application, and Electron appears to be unable to frame websites which set `frame-ancestors *` in its response headers: electron/electron#26369 If I'm reading the CSP specification correctly, omitting the frame-ancestors directive altogether is equivalent to setting `frame-ancestors *`, so to my knowledge this PR should not result in a behavior change for environments which correctly implement the CSP spec. From https://w3c.github.io/webappsec-csp/2/#directive-frame-ancestors: > The term allowed frame ancestors refers to the result of parsing the frame-ancestors directive’s value as a source list. If a frame-ancestors directive is not explicitly included in the policy, then allowed frame ancestors is "*".
|
All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the ℹ️ Googlers: Go here for more info. |
|
CLAs are okay since this is just a backport of #4332, whose original |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
3 participants
Backport of #4332 to 2.4. Cf. #4547.
This PR essentially reverses #2797.
Currently this doesn't work because the
frame-ancestors *directive prevents VS Code from framing TensorBoard. This is because VS Code is an Electron application, and Electron appears to be unable to frame websites which setframe-ancestors *in its response headers: electron/electron#26369If I'm reading the CSP specification correctly, omitting the frame-ancestors directive altogether is equivalent to setting
frame-ancestors *, so to my knowledge this PR should not result in a behavior change for environments which correctly implement the CSP spec. From https://w3c.github.io/webappsec-csp/2/#directive-frame-ancestors:Co-authored-by: Joyce Er joyceerhuiling@gmail.com