[daniel-beck]

Fixes #609.

This specifically addresses the problem of

• CSP enforcement enabled (Jenkins 2.539+)
• Resource Root URL enabled

not rendering HTML report content due to frame-src limitations.

While showing an action from this plugin, the CSP directive specifically allows an additional frame-src being the RRU. To do that well, we're using @Restricted API from core, which isn't ideal, but I think is defensible. It can be opened up to plugins if this ends up the long term solution.

To limit what the content shown in the iframe can do, apply a sandbox attribute and do not include allow-top-navigation (so the report stays in its frame).

The legacy wrapper file option (#186) is currently broken: Any HTML reports archived after cfcaf02 will not work as long as CSP is enforced, as they will always contain inline JS.

Any HTML reports archived before that commit will work again with this fix, even with RRU enabled + CSP enforced. Those HTML reports do not apply the new sandbox attribute added in this PR though, yet another reason the "legacy wrapper" option is a bad idea.

While this implementation sketches out a path forward for legacy wrapper file support despite CSP, I strongly discourage attempting to relax JS restrictions. Instead, #597 should be implemented.

Testing done

Without this fix:

CSP off, RRU off, legacy off:  OK but no JS
CSP off, RRU off, legacy on:  OK but no JS
CSP off, RRU on, legacy off: OK + JS
CSP off, RRU on, legacy on: OK + JS

CSP on, RRU off, legacy off: OK but no JS
CSP on, RRU off, legacy on: broken (script-src) if new; OK but no JS if old.
CSP on, RRU on, legacy off: broken (frame-src)
CSP on, RRU on, legacy on: broken (script-src) if new; broken (frame-src) if old.

Changes with this fix:

CSP on, RRU on, legacy off: OK + JS
CSP on, RRU on, legacy on: broken (script-src) if new; OK + JS if old.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[Copilot]

🟡 Changes recommended

The sandbox breaks origin-dependent interactive reports on the isolated resource domain and blocks report downloads, requiring origin-aware permissions and allow-downloads to preserve existing functionality.

2 open issues

• Allow downloads from report wrappers · New
• Preserve report origin in the isolated resource domain · New

What changed in this PR

This PR addresses #609 by allowing HTML Publisher reports to load from the Resource Root URL when Jenkins Content Security Policy enforcement is enabled.

Changes:

• Adds an action-scoped frame-src allowance and CSP headers to both wrapper-rendering paths.
• Adds sandbox restrictions to report iframes.
• Raises the Jenkins baseline to 2.541.3, updates the dependency BOM, and enables beta API usage.

File	Description
src/​main/​resources/​htmlpublisher/​HtmlPublisherTarget/​BaseHTMLAction/​index.groovy	Includes CSP headers in current and legacy wrapper responses.
src/​main/​resources/​htmlpublisher/​HtmlPublisher/​footer.html	Adds sandbox permissions to the report iframe.
src/​main/​java/​htmlpublisher/​CspContributor.java	Allows the resource-domain origin in frame-src for report actions.
pom.xml	Updates the Jenkins baseline and BOM; enables beta APIs.

_{Review effort: Balanced}

[long76]

maybe URI would better

[Kevin-CB]

I tested this locally and confirmed that the fix works with both CSP enforcement and RRU enabled.

I also reproduced the issues mentioned in the two Copilot comments (allow-downloads and allow-same-origin), although I'm not sure how common or relevant these use cases are in practice.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Kevin-CB]

Not retested

[Copilot]

🔵 Needs a closer look

The request-scoped CSP allowance lacks regression tests confirming the Resource Root URL origin on report wrappers and its absence on unrelated pages or when no Resource Root URL is configured.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Add regression tests for request-scoped CSP allowance

src/​main/​java/​htmlpublisher/​CspContributor.java:72

The new request-scoped CSP allowance has no automated regression coverage, so a missing resource origin or an allowance leaking onto unrelated pages could go undetected. Add JenkinsRule tests that fetch build- and project-level report wrappers with CSP enforcement enabled and assert that frame-src includes the configured Resource Root URL origin. Also verify that the contribution is absent on unrelated Jenkins pages and when no Resource Root URL is configured.

2 resolved since last review

• Preserve report origin in the isolated resource domain
• Allow downloads from report wrappers

_{Review effort: Balanced}