From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <Tobias_Burnus@mentor.com>
Received: from esa3.mentor.iphmx.com (esa3.mentor.iphmx.com [68.232.137.180])
	by sourceware.org (Postfix) with ESMTPS id 10E263858D35
	for <gcc-patches@gcc.gnu.org>; Thu, 10 Nov 2022 10:36:58 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 10E263858D35
Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=codesourcery.com
Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=mentor.com
X-IronPort-AV: E=Sophos;i="5.96,153,1665475200"; 
   d="scan'208,217";a="86418178"
Received: from orw-gwy-02-in.mentorg.com ([192.94.38.167])
  by esa3.mentor.iphmx.com with ESMTP; 10 Nov 2022 02:36:58 -0800
IronPort-SDR: VYmtF2hptKd3wCyw/eVzWwGSpYFLT5OgUEPLEZjyCCRvyaqgyle5JweRYtKLOjQ07h/Ro4d86K
 DCa/YtRbaoAk0Lu6M02126C28Fpu8FUt8D2fw8hlYVl0iiTsrQaZajjQXBkfjpUsro3AwElAbm
 XP5riHYY94O/HqV37IhvDtaniS/jUqZ2Cwr8wD0mhFMpI18+vxR8O1hmegzoSwjRuqp70BIrEY
 9PolaTEsqr7zILrxbpYBn2q5Pt/0j4yYZk98CrYJatXEj2USiUVCGGAZpk2f7+/yXBwuTZPjC5
 xEY=
Message-ID: <868ba580-dc90-7473-8bc0-7b8d5dae4cd0@codesourcery.com>
Date: Thu, 10 Nov 2022 11:36:50 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.2
Subject: Re: [DOCS] sphinx: use new Sphinx links
Content-Language: en-US
To: <gcc-patches@gcc.gnu.org>, Gerald Pfeifer <gerald@pfeifer.com>
References: <482ae3dd-15f7-1e81-92e6-51a148e3bbc4@suse.cz>
 <2832f3b5-f815-3922-3681-edd55ca04dd5@suse.cz>
 <1656d2ca-f3b3-b46e-cf16-a6798e10deb1@suse.cz>
 <9c9b4969-dc72-a93b-335b-d72346bb437e@pfeifer.com>
 <8ae80e2a-9f49-4ebf-d7f0-815d32919573@suse.cz>
 <39fb5822-95aa-037a-5ac7-865e9096ff9f@pfeifer.com>
 <b90d6ce4-4086-976e-3009-dbb28fad52ae@suse.cz>
 <638cad2d-9463-ad35-4b67-d18b42027521@pfeifer.com>
From: Tobias Burnus <tobias@codesourcery.com>
In-Reply-To: <638cad2d-9463-ad35-4b67-d18b42027521@pfeifer.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: [137.202.0.90]
X-ClientProxiedBy: svr-ies-mbx-14.mgc.mentorg.com (139.181.222.14) To
 svr-ies-mbx-12.mgc.mentorg.com (139.181.222.12)
X-Spam-Status: No, score=-5.4 required=5.0 tests=BAYES_00,HEADER_FROM_DIFFERENT_DOMAINS,KAM_DMARC_STATUS,KAM_SHORT,NICE_REPLY_A,SPF_HELO_PASS,SPF_PASS,TXREP autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org
List-Id: <gcc-patches.gcc.gnu.org>

Hi,

On 10.11.22 11:03, Gerald Pfeifer wrote:
> On Thu, 10 Nov 2022, Martin Li=C5=A1ka wrote:
>>> https://gcc.gnu.org/install/ is back with a new face.
>> But it's not working properly due to some Content Security Policy:
> Hmm, it worked in my testing before and I just tried again:
> Firefox 106.0.1 (64-bit)

Did you open the console (F12)? If I do, I see the errors:

Content Security Policy: The page=E2=80=99s settings blocked the loading of=
 a
resource at inline (=E2=80=9Cdefault-src=E2=80=9D). That's for line 18, whi=
ch is
'<style>'. The next one is for line 42 (same error) which is for:
<script>document.body.dataset.theme =3D localStorage.getItem("theme") ||
"auto"; </script>And then there is twice: Content Security Policy: The
page=E2=80=99s settings blocked the loading of a resource at
data:image/svg+xml;charset=3Dutf-8,<svg xm=E2=80=A6 (=E2=80=9Cdefault-src=
=E2=80=9D).

> (It feels a bit curious how the position in the web server's file system
> or a symlink could trigger something like that?)

If you look at the output of 'curl -I', which shows only the HTTP header, y=
ou will
see that only the /install/ URL has:

content-security-policy: default-src 'self' http: https:

There must be some server configuration that add this - but it does not see=
m
to be in the .ht* files in the wwwdocs git repo.

I could imaging that /install often contains some files in the default conf=
ig
such that the central Apache configuration contains has this line to disall=
ow code.
As most production servers don't use /install - it won't affect them and pr=
otects
them from some issues. =E2=86=92 Something for overseers to check.


For a description, see:
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Secur=
ity-Policy

* * *

> Looking at the source code of index.html I am wondering about
>    <html class=3D"no-js" lang=3D"en">
> versus all the .js inclusions later on.

But that only confuses humans - for the computer, it is just the name of
a CSS style sheet class.

Tobias

-----------------
Siemens Electronic Design Automation GmbH; Anschrift: Arnulfstra=C3=9Fe 201=
, 80634 M=C3=BCnchen; Gesellschaft mit beschr=C3=A4nkter Haftung; Gesch=C3=
=A4ftsf=C3=BChrer: Thomas Heurung, Frank Th=C3=BCrauf; Sitz der Gesellschaf=
t: M=C3=BCnchen; Registergericht M=C3=BCnchen, HRB 106955