mohmesflir opened a new issue, #4651: URL: https://github.com/apache/couchdb/issues/4651
[NOTE]: # ( ^^ Provide a general summary of the issue in the title above. ^^ ) ## Description The [csp] header parameters (attachments_header_value, showlist_header_value, utils_header_value, and [depreciated] header_value) require a semicolon separated list but the interpreter sees the semicolon as the start of a comment and so only the first list item is loaded from the .ini file. [NOTE]: # ( Describe the problem you're encountering. ) [TIP]: # ( Do NOT give us access or passwords to your actual CouchDB! ) ## Steps to Reproduce From default.ini, an example CSP section may look like: ``` ; CSP (Content Security Policy) Support [csp] utils_enable = true utils_header_value = default-src 'self'; img-src 'self'; font-src *; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-modals allow-orientation-lock allow-pointer-lock allow-presentation allow-popups-to-escape-sandbox allow-top-navigation; attachments_enable = true attachments_header_value = default-src 'self'; img-src 'self'; font-src *; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-modals allow-orientation-lock allow-pointer-lock allow-presentation allow-popups-to-escape-sandbox allow-top-navigation; showlist_enable = true showlist_header_value = default-src 'self'; img-src 'self'; font-src *; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-modals allow-orientation-lock allow-pointer-lock allow-presentation allow-popups-to-escape-sandbox allow-top-navigation; ``` and this can be saved in the local.d ini file using the config tool. However, when the service is restarted, only the first item in each list is loaded because the first semicolon is seen as the start of a comment. Manually changing the settings in localhost:5984/_utils/#_config/couchdb@localhost to:  After restarting the service this is what you get:  Everything after the first semicolon is missing. [NOTE]: # ( Include commands to reproduce, if possible. curl is preferred. ) ## Expected Behaviour Unfortunately CSP requires the semicolon separation and will not accept a comma. If these semicolons are changed to commas then the list reloads but fails to actually work when trying to load webpages served by the CouchDB server. So either: - an escape character is needed for the semicolon - the server needs to change the comma to a semicolon - the ini loader needs to ignore the semicolon on these specific lines [NOTE]: # ( Tell us what you expected to happen. ) ## Your Environment [TIP]: # ( Include as many relevant details about your environment as possible. ) [TIP]: # ( You can paste the output of curl http://YOUR-COUCHDB:5984/ here. ) * CouchDB version used: tested on 3.2.2 and 3.2.1 * Operating system and version: Windows Server 2022 Standard 21H2 (OS build 20348.469) ## Additional Context [TIP]: # ( Add any other context about the problem here. ) Additional installations on Windows 10 PCs are not showing this issue, only the Windows Server installation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
