当前使用 hudson.model.DirectoryBrowserSupport.CSP 问题覆盖了默认的 Content-Security-Policy

Question

将 Jenkins 升级到 v2.222.1 后，我们收到以下警告消息

The default Content-Security-Policy is currently overridden using the hudson.model.DirectoryBrowserSupport.CSP system property, which is a potential security issue when browsing untrusted files. As an alternative, you can set up a Resource Root URL that Jenkins will use to serve some static files without adding Content-Security-Policy headers.

我们不希望有单独的来源来提供静态内容，同时必须解决此警告，很高兴提供您的建议..

Answer 1

默认情况下，当您使用 HTML Publisher 插件发布任何报告时，不会显示 CSS 内容。 Jenkins 根据 CSP(Content Security Policy) 阻止 CSS。

参考：https://www.jenkins.io/doc/book/system-administration/security/configuring-content-security-policy/

启用 CSS 内容：Manage Jenkins -> Script Console 并执行 System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "")

启用 CSS 后，您会收到以下警告 The default Content-Security-Policy is currently overridden using the hudson.model.DirectoryBrowserSupport.CSP system property, which is a potential security issue when browsing untrusted files.

要禁用它，只需重新启动 Jenkins 服务器。 CSP 将再次设置为默认值。