Demos: Add Content Security Policy (CSP) validation by EugeniyKiyashko · Pull Request #32731 · DevExpress/DevExtreme

EugeniyKiyashko · 2026-02-27T12:41:23Z

No description provided.

Copilot

Pull request overview

Adds automated CSP (Content Security Policy) “report-only” validation for the demos, so CI can detect CSP violations across jQuery + framework demos and publish a consolidated report.

Changes:

Introduces an Express-based CSP report-only server for demos, plus scripts to run CSP checks and summarize violations.
Extends TestCafe visual tests to inject a CSP violation listener and write violations into a report file when enabled.
Adds GitHub Actions jobs to run CSP checks per framework and generate a merged step summary + artifacts.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
package.json	Adds a root-level script to start demos with the CSP server.
apps/demos/utils/visual-tests/inject/csp-listener.js	Captures `securitypolicyviolation` events in the browser during tests.
apps/demos/utils/server/csp-server.js	Implements CSP Report-Only middleware, report endpoints, and nonce injection for framework demos.
apps/demos/utils/server/csp-report-summary.js	Adds a CLI summarizer for CSP violation reports.
apps/demos/utils/server/csp-check.js	Adds a headless Chrome crawler to visit demo pages and query CSP violations from the server.
apps/demos/testing/common.test.ts	Optionally injects the CSP listener and writes JSONL violation output during TestCafe runs.
apps/demos/package.json	Adds scripts to run CSP server/check/report and a CSP-enabled TestCafe run.
apps/demos/.gitignore	Ignores generated `csp-reports/` output.
.github/workflows/visual-tests-demos.yml	Adds CI jobs to run CSP checks per framework and publish a consolidated report.

apps/demos/utils/server/csp-check.js

apps/demos/utils/server/csp-report-summary.js

apps/demos/utils/server/csp-server.js

.github/workflows/visual-tests-demos.yml

apps/demos/utils/server/csp-check.js

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

.github/workflows/visual-tests-demos.yml

apps/demos/utils/server/csp-server.js

apps/demos/utils/server/csp-check.js

apps/demos/testing/common.test.ts

apps/demos/package.json

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

.github/workflows/visual-tests-demos.yml

Copilot · 2026-03-04T10:29:07Z

apps/demos/utils/server/csp-check.js

+function visitPage(url) {
+  return new Promise((resolve) => {
+    const child = execFile(CHROME_PATH, [
+      '--headless=new',
+      '--no-sandbox',
+      '--disable-gpu',
+      '--disable-software-rasterizer',
+      '--disable-dev-shm-usage',
+      '--screenshot=/dev/null',
+      '--window-size=100,100',
+      url,
+    ], { timeout: 30000 }, () => resolve());
+    child.on('error', () => resolve());
+  });


visitPage resolves even if Chrome fails to start or returns an error (both the execFile callback and the error event unconditionally call resolve()). This can lead to false-green CSP checks (no pages actually loaded → no reports collected). Consider rejecting on process errors / non-zero exit codes and failing the run (or at least tracking failed navigations and setting a non-zero exit code).

apps/demos/utils/server/csp-report-summary.js

apps/demos/utils/server/csp-server.js

apps/demos/utils/server/csp-check.js

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

apps/demos/Demos/Accordion/Overview/jQuery/index.html

apps/demos/utils/server/csp-check.js

apps/demos/utils/server/csp-report-summary.js

apps/demos/utils/server/csp-server.js

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Copilot · 2026-03-04T14:27:41Z

.github/workflows/visual-tests-demos.yml

+    - name: Start CSP Server
+      run: node apps/demos/utils/server/csp-server.js 8080 &
+
+    - name: Run CSP Check
+      working-directory: apps/demos
+      env:
+        CSP_FRAMEWORKS: ${{ matrix.FRAMEWORK }}
+        CHROME_PATH: google-chrome-stable
+      run: node utils/server/csp-check.js


The CSP server is started in the background and the next step immediately runs the checker. Without a readiness check, this can race on slower runners and cause flaky failures. Add a short wait/health-check loop (e.g., poll /csp-violations until it responds) before running csp-check.js.

Copilot · 2026-03-04T14:27:42Z

apps/demos/testing/common.test.ts

+const cspReportDir = join(__dirname, '..', 'csp-reports');
+const cspReportFile = join(cspReportDir, 'csp-violations.jsonl');
+
+const writeCspReport = (testName: string, framework: string, violations: any[]) => {
+  if (!violations.length) return;
+  if (!existsSync(cspReportDir)) {
+    mkdirSync(cspReportDir, { recursive: true });
+  }
+  for (const v of violations) {
+    const entry = {
+      test: testName,
+      framework,
+      ...v,
+    };
+    appendFileSync(cspReportFile, `${JSON.stringify(entry)}\n`);
+  }


CSP reporting appends to a fixed csp-violations.jsonl file but never clears it, so rerunning tests can mix stale violations into a new run. Consider truncating/removing the file once at startup when CSP_REPORT=true (and batching writes per test to reduce synchronous I/O in large runs).

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Copilot · 2026-03-04T19:22:42Z

apps/demos/utils/server/csp-server.js

+    res.locals.cspNonce = nonce;
+  }
+
+  res.setHeader('Content-Security-Policy', buildCspHeader(demoKey, nonce, framework));


The server logs "CSP Report-Only mode enabled", but the middleware sets the enforcing Content-Security-Policy header. This is either misleading output or will unintentionally block resources during CSP runs. Use Content-Security-Policy-Report-Only if the intent is validation-only, or update the startup logs/comment to reflect enforced mode.

Suggested change

res.setHeader('Content-Security-Policy', buildCspHeader(demoKey, nonce, framework));

res.setHeader('Content-Security-Policy-Report-Only', buildCspHeader(demoKey, nonce, framework));

Copilot · 2026-03-04T19:22:42Z

apps/demos/utils/server/csp-check.js

+    const child = execFile(CHROME_PATH, [
+      '--headless=new',
+      '--no-sandbox',
+      '--disable-gpu',
+      '--disable-software-rasterizer',
+      '--disable-dev-shm-usage',
+      '--dump-dom',
+      '--virtual-time-budget=5000',
+      '--window-size=100,100',
+      url,
+    ], { timeout: 30000 }, () => resolve());
+    child.on('error', (err) => {
+      reject(new Error(`Failed to launch Chrome at "${CHROME_PATH}": ${err.message}`));
+    });
+  });


visitPage resolves successfully even when Chrome exits with an error (non-zero exit code, navigation failure, timeout). Because the execFile callback ignores the error argument, CSP checks can silently pass while pages fail to load. Reject the promise when the callback receives an error so the job fails on real page-load issues.

Copilot · 2026-03-04T19:22:42Z

apps/demos/testing/common.test.ts

+const isCspEnabled = () => process.env.CSP_REPORT === 'true';
+
+const cspReportDir = join(__dirname, '..', 'csp-reports');
+const cspReportFile = join(cspReportDir, 'csp-violations.jsonl');
+
+const writeCspReport = (testName: string, framework: string, violations: any[]) => {
+  if (!violations.length) return;
+  if (!existsSync(cspReportDir)) {
+    mkdirSync(cspReportDir, { recursive: true });
+  }
+  for (const v of violations) {
+    const entry = {
+      test: testName,
+      framework,
+      ...v,
+    };
+    appendFileSync(cspReportFile, `${JSON.stringify(entry)}\n`);
+  }


The CSP report file is only appended to and never cleared/truncated when CSP reporting is enabled. Re-running the TestCafe suite locally (or in any environment that reuses the workspace) will accumulate stale violations and make the summary inaccurate. Consider deleting/truncating csp-violations.jsonl once at the start of the run (when CSP_REPORT=true) before appending entries.

Copilot · 2026-03-04T19:22:43Z

apps/demos/utils/server/csp-server.js

+  const fileSystemPath = resolve(demosBaseDir, widget, name, approach, indexFileName);
+
+  if (!fileSystemPath.startsWith(demosBaseDir)) {
+    response.status(403).send('Forbidden');
+    return;
+  }


The path traversal guard uses fileSystemPath.startsWith(demosBaseDir), which can be bypassed by paths like .../DemosX/... when .. segments are used in params (prefix match). Prefer a path.relative(demosBaseDir, fileSystemPath) check that rejects absolute paths and any relative path starting with .. to robustly prevent escaping the demos directory.

Copilot · 2026-03-04T19:22:43Z

.github/workflows/visual-tests-demos.yml

+    - name: Start CSP Server
+      run: node apps/demos/utils/server/csp-server.js 8080 &
+
+    - name: Run CSP Check
+      working-directory: apps/demos
+      env:
+        CSP_FRAMEWORKS: ${{ matrix.FRAMEWORK }}
+        CHROME_PATH: google-chrome-stable
+      run: node utils/server/csp-check.js
+


Same as in the jQuery job: the CSP server is started in the background and the check runs immediately. Add a readiness wait (poll an endpoint) to avoid intermittent connection errors in CI.

EugeniyKiyashko self-assigned this Feb 27, 2026

EugeniyKiyashko added the 26_1 label Feb 27, 2026

EugeniyKiyashko force-pushed the 26_1_csp_in_demos branch from 595a390 to 8a995cb Compare February 27, 2026 16:10

EugeniyKiyashko changed the title ~~Demos: run testing with testcafe~~ Demos: run testing Feb 27, 2026

EugeniyKiyashko changed the title ~~Demos: run testing~~ Demos: check CSP Feb 27, 2026

EugeniyKiyashko added the force all tests label Feb 27, 2026

EugeniyKiyashko added 4 commits February 27, 2026 20:14

Demos: run testing with testcafe

3a3edad

update

bd4d819

update rule

c82de20

parallel frameworks

29b9cf6

EugeniyKiyashko force-pushed the 26_1_csp_in_demos branch from 8a995cb to 29b9cf6 Compare February 27, 2026 16:14

EugeniyKiyashko added 6 commits March 3, 2026 16:33

add allow list

39145dc

Update csp-server.js

6492b92

extend allow list

f8b56ab

allow some issues in React, Vue

9d5dfd0

run demos in parallel

1eb5cfc

remove excess commands

6603cc3

EugeniyKiyashko changed the title ~~Demos: check CSP~~ Demos: run CSP testing Mar 4, 2026

EugeniyKiyashko marked this pull request as ready for review March 4, 2026 09:10

EugeniyKiyashko requested a review from a team as a code owner March 4, 2026 09:10

Copilot AI review requested due to automatic review settings March 4, 2026 09:10

EugeniyKiyashko changed the title ~~Demos: run CSP testing~~ Demos: Add Content Security Policy (CSP) validation Mar 4, 2026

Copilot started reviewing on behalf of EugeniyKiyashko March 4, 2026 09:11 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

EugeniyKiyashko added 3 commits March 4, 2026 13:19

improve chrome using

c6a12fb

fix copilot remarks

df6ff47

Update csp-check.js

1e32e47

Copilot AI review requested due to automatic review settings March 4, 2026 09:27

Copilot started reviewing on behalf of EugeniyKiyashko March 4, 2026 09:28 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

EugeniyKiyashko added 4 commits March 4, 2026 13:38

remove excess comments

eae8cad

refactor

d81b237

refactor

4f63f4f

Update csp-server.js

87c60f1

Copilot AI review requested due to automatic review settings March 4, 2026 10:23

Copilot started reviewing on behalf of EugeniyKiyashko March 4, 2026 10:23 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

refactoring + test csp issue

ebac448

pharret31 requested a review from a team as a code owner March 4, 2026 11:57

refactor

1a63170

Copilot AI review requested due to automatic review settings March 4, 2026 12:32

Copilot started reviewing on behalf of EugeniyKiyashko March 4, 2026 12:33 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

pharret31 and others added 2 commits March 4, 2026 13:55

remove csp issues

93b98fd

fix CSP issue

6314c24

Copilot AI review requested due to automatic review settings March 4, 2026 14:20

dmlvr requested a review from a team as a code owner March 4, 2026 14:20

Copilot started reviewing on behalf of dmlvr March 4, 2026 14:21 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

pharret31 added 2 commits March 4, 2026 19:24

fix jquery csp issues

d792bf3

fix frameworks csp issues

69001ec

Copilot AI review requested due to automatic review settings March 4, 2026 19:16

Copilot started reviewing on behalf of pharret31 March 4, 2026 19:18 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

fix frameworks csp issues

51f83e4

	res.setHeader('Content-Security-Policy', buildCspHeader(demoKey, nonce, framework));
	res.setHeader('Content-Security-Policy-Report-Only', buildCspHeader(demoKey, nonce, framework));

Conversation

EugeniyKiyashko commented Feb 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development