Keep getting CSP errors: "Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'"
The problem is probably due to HTML files generated by GWT which contain inline JS.
UPD: Changing to manifest version 1 helped, but this is a temporary workaroud, as Chrome 21 complains that it will no longer be supported.
UPD2: <add-linker name="xsiframe" /> does not help either
GWT 2.5.1 has finally fixed this problem. The release notes documenting this are here:
https://developers.google.com/web-toolkit/release-notes#Release_Notes_2_5_1
and they state that:
"Apps built with DirectInstallLinker should work in a page where inline scripts are forbidden (e.g. a Chrome extension)"
This means that it is now possible to use DirectInstallLinker to link your Chrome packaged app in a manner that satisfies the new security requirements of manifest version 2 regarding inline scripts. That is, by using DirectInstallLinker to link your app with GWT 2.5.1 selected as your GWT version, GWT will not place any script elements inline in its generated Javascript, and thus the new manifest version 2 requirement that there be no inline scripts will not be violated.
I have found that SingleScriptLinker also seems to work for my own app; however, Issue 7685 warns against using the SingleScriptLinker because "This generates a $doc.write line which is forbidden in packaged apps." I am using DirectInstallLinker myself.
Here is the Javadoc for DirectInstallLinker:
http://google-web-toolkit.googlecode.com/svn/javadoc/2.5/com/google/gwt/core/linker/DirectInstallLinker.html
To use this linker, you can include the following in your *.gwt.xml file:
<define-linker name="dil" class="com.google.gwt.core.linker.DirectInstallLinker"/>
<add-linker name="dil" />
(dil can be replaced by anything you choose, so long as there are no dashes or other illegal characters).
You will need to select GWT 2.5.1 as your version of GWT. If you're using an older version of GWT in an out-of-date version of Eclipse such as Ganymede (as I was), you'll have to upgrade to at least Helios and then import your project to your new Eclipse environment. The archive URLs for the Google Plugin for Eclipse that can be used for the latest three Eclipse versions can be found here:
https://developers.google.com/eclipse/docs/download
With the above in place, you should be able to set
"manifest_version": 2
in your manifest.json file and not experience any errors due to GWT-generated inline Javascript. This should allow your Chrome Web app to be acceptable to the Chrome Web Store (which now requires manifest version 2 for any new apps or for updates to present apps), so long as there are no other issues.
EDIT: new GWT bug reported: http://code.google.com/p/google-web-toolkit/issues/detail?id=7685, see also http://gwt-code-reviews.appspot.com/1838803/ which is related to this bug
In other words, it looks like, when fixed, you'll simply have to use the DirectInstallLinker (<add-linker name='direct_install'/>).
In the mean time, IIUC, you'd have to extend DirectInstallLinker and:
override getJsInstallLocation to return a copy a installLocaltionIframe.js without the $wnd part
override getModulePrefix to prepend var $wnd = $wnd || window.parent; to what's generated by super.getModulePrefix
I don't know CSP enough to give a complete answer, but the xsiframe linker is "customizable": create a class that extends com.google.gwt.core.linker.CrossSiteIframeLinker and overrides the appropriate methods, then use with a <define-linker> and <add-linker> in your *.gwt.xml.
For instance, getJsInstallLocation defaults to com/google/gwt/core/ext/linker/impl/installLocationIframe.js but there's a com/google/gwt/core/ext/linker/impl/installLocationMainWindows.js alternate implementation.
Similarly (and probably more importantly), getJsInstallScript defaults to com/google/gwt/core/ext/linker/impl/installScriptEarlyDownload.js but there's also a com/google/gwt/core/ext/linker/impl/installScriptDirect.js alternate implementation.
See http://code.google.com/p/google-web-toolkit/source/browse/trunk/dev/core/src/com/google/gwt/core/linker/CrossSiteIframeLinker.java#204, http://code.google.com/p/google-web-toolkit/source/browse/trunk/dev/core/src/com/google/gwt/core/ext/linker/impl/ and http://code.google.com/p/google-web-toolkit/source/browse/trunk/user/src/com/google/gwt/core/Core.gwt.xml
Thanks to Thomas Broyer's advice. I created this GWT Linker. Now my GWT application runs perfectly as an Chrome Application (Tested on Chrome 32 and GWT 2.5.1).
public class CSPCompatibleLinker extends DirectInstallLinker {
#Override
protected String getJsInstallLocation(LinkerContext context) {
return "com/google/gwt/core/ext/linker/impl/installLocationMainWindow.js";
}
}
Dont forget to declare the Linker into your*.gwt.xml file:
<define-linker name="csp" class="com.sfeir.linker.CSPCompatibleLinker"/>
<add-linker name="csp" />
Manifest version 2 does not allow inline scripts. You need to make sure all scripts are linked instead and no JavaScript in HTML elements.
Related
I have an app that I started using the out of the box MAUI project template. I have been running it on both a local Android emulator and a remote Mac emulator. It had been working on both, and then today after running it on Android for a while, I changed the debugger to use the Mac emulator. It immediately refused to compile, and listed every Android class reference as "type or namespace [blah] could not be found". After playing with several things, I found that if I commented out the "using Java.Net" on the default MainPage.xaml.cs, all of the compiler errors went away. If I uncomment it again, then all 20 something compiler errors show up again. This is the out of the box MainPage.xaml that came with the project template, plus one click event handler that I added - is there some known issue here?
As I said, it was working fine for nearly two weeks, and then just went bananas on me today. Haven't added any nuget packages or anything like that - just been writing code.
Thanks.
You've described the issue in your question:
using "Java.Net" on the default MainPage.xaml.cs.
That won't compile for any platform except Android.
It doesn't exist on the default MainPage.xaml.cs (which you could have verified by creating a new project).
My recommendation: Start over with a fresh project. Add again whatever you added, and see if that using appears again. If it does, you've added something Android specific. Which doesn't make sense, on a cross-platform page.
If using does appear again, and you don't understand why, then add to your question the exact code which, when added to page, causes using Java.net; to appear.
If you were following some example, also add a link to the example web page.
UPDATE
I have a theory about how that using got there:
I bet you added a reference to some class which exists in Java.net namespace.
So Visual Studio gave you an option to add a "using".
If that happens again, and a "using" mentions Android or Java, DON'T add the using, UNLESS you are in a file inside your project's Platforms/Android folder.
Some class names exist both in an Android or Java namespace, and in a .Net or Maui namespace. In cross-platform code, pick the cross-platform using, not the platform-specific one. If they are in different namespaces, they are different classes - even if the names are the same.
i'm having some issues getting modules to work on my app - I keep on getting told that the requested module cannot be found.
It is entirely possible that i'm not installing the modules correctly - so, for the purposes of this question:
Once i've downloaded the zip file from git hub using the green "download" button, what do i do to import the module into my project? Not how do i tell tiapp.xml to use the module - just what do i do to install it?
Can you please run through using the facebook module found at https://github.com/appcelerator-modules/ti.facebook
thanks!
Inside the zip file of the download you'll see there is a folder called modules. This is the same folder that is in your root of the project.
So, an iOS module should be installed in the /modules/iphone folder. Once added, you can add Facebook to your app like this:
<module platform="iphone">facebook</module>
If you want to specify a version you can do so like this:
<module platform="iphone" version="1.1.0>facebook</module>
note: I made up the version number
You can also add it through the tiapp editor in Appcelerator studio, although it doesn't always seem to find the module. This might be a bug in studio though, usually it works great.
HMMMM
Two main issues here, one directly relating, the other less so.
Issue 1
The link i gave to get the codebase from github is wrong - well, it gets the codebase, but not in a form that can be used as a module. It is, in fact, the uncompiled version.
Versions for download can be found here.
So that takes care of issue one, what about
Issue 2
The latest version for use is a bit broken. Seems someone (from the appcelerator team???) decided to make the latest 6.0.1 release have a minsdk of the (at this time) as-yet-unreleased version 6.0.0, and sets the apiversion to 3.
This breaks the current release of 5.5.1, so for anyone reading this prior to 6.0.0 for appcelerator, you will want to use this release version.
As far as I know the "user.agent" property in the Google Web Toolkit .gwt.xml file specifies the targets for the Java to Java Script translation. Because the hosted mode still runs Java and not Javascript I don't understand why google chrome complains that the "user.agent" value is not set correctly. Even more strange, it keeps complaining even if I add "safari" to it with <set-property name="user.agent" value="gecko1_8,safari" />.
What can I do here?
I use GWT version 2.3.0 and GXT version 2.2.5.
DevMode does not compile to JavaScript but still has to honor deferred binding rules, and many of them are based on the user.agent property, so it must be correctly set.
The user.agent property value is determined by some script snippet generated in the so-called selection script (the *.nocache.js file), and the content of this script can depend on the set-propertys you have in your GWT module(s).
For instance, if you compile a GWT module with <set-property name="user.agent" value="gecko1_8" />, the user.agent property will be hard-coded to the gecko1_8 value in the *.nocache.js.
If you later run DevMode, unless it thinks it has to overwrite the existing *.nocache.js, it'll use it; so running the app using Chrome when the *.nocache.js was generated for gecko1_8 only will cause an error similar to:
com.google.gwt.core.client.JavaScriptException: (TypeError): Property 'user.agent' of object is not a function
In case you compiled for several browsers, but then run DevMode with a module only for gecko1_8, then the DevMode will use the property provider found in the *.nocache.js to determine the actual user agent being used (woul dbe safari for Chrome), and will compare it with the one determined from the module (hard-coded here to gecko1_8), and will then warn you that they don't match (and as such that you app might dysfunction: the code will use DOMImplMozilla for instance, whereas DOMImplSafari should have been used in Chrome).
So, to fix this, either delete the *.nocache.js file so DevMode will have to generate a new one, or recompile your app with a module whose user.agent values match the browser you'll use in DevMode.
I am using Eclipse for Android dev and everything was going fine until I tried to incorporate the facebook SDK. Now when I tried to back it out, there appears to be an artifact left behind that Eclipse tries to link the FB library?!?
[2010-11-17 18:50:22 - Library Project] Unable to set linked path var '_android_com.facebook.android' for library /Users/mobibob/Projects/workspace/facebook-android-sdk/facebook: Path variable name cannot contain character: ..
Any clue where this command / reference is in the build configuration? I have scoured it as best that I can, but I still get the same error.
Problem solved ... as it turns out, it was not so much the Facebook SDK but something that I did in the process of configuring the library reference. I am not entirely certain of how I misconfigured, but I was tweaking the various "path" settings such that, once when the automatic build tried to build my project, an import for android.R was added to my source module. This superseded com.myproject.R and would not resolve the values for resource references.
There were other problems with path order and setting that I modified during the troubleshooting that made it worse. Recreating the project without Facebook was the first step to discovery and fixing.
Either way, the lesson I learned is that the build error messages can misdirect one to the configuration when the problem is in the source code.
I'm ramping up on Vaadin and I'm getting this javascript alert whenever I try and run the demo apps.
GWT module 'com.vaadin.terminal.gwt.DefaultWidgetSet' may need to be recompiled
I've tried cleaning the project to no avail.
As I said, I'm ramping up so I'm sure there's some simple step I'm missing or a concept I haven't grasped.
I don't know anything about Vaadin, but there's a more general context in which this error occurs:
So long as you're testing in Eclipse, the dynamic coding of your app is still real Java coding being run in a JVM. This coding is made available through debugger that's accessible via a socket. You get a URL that looks like this:
http://127.0.0.1:8888/MyApp.html?gwt.codesvr=127.0.0.1:9997
with this codesvr thing being your eclipse-hosted debugger process for your Java code.
Before your app can run standalone, GWT has to translate your Java code to JavaScript; separate versions of the code are produced for each browser type (Firefox, WebKit, Opera, ...) and language that you want to support. Only once this is done can you access your app the usual way via
http://127.0.0.1:8888/MyApp.html
After weeks of running my app only in Eclipse, I'd managed to forget about the compiling-for-browsers step and wondered about the message. The way to fire up the compiler, if you're not using the Ant task, is to hit Google|GWT Compile in the project's context menu. That done, the JS in your app gets fleshed out and your app can run without Java on the client side.
And of course the message goes away.
It is a warning not an error. Does the app work? Otherwise you have to recompile the Vaadin widgetset. These might help too: http://vaadin.com/directory/help/using-vaadin-add-ons
Often this message meens:
you're missing the ?gwt.codesvr=127.0.0.1:9997 parameter in the URL (or have misspelled it).
your module uses the xs linker <add-linker name="xs" />. This is a known limitation and will be fixed in the future: Issue 4232: Allow Development Mode to work with XS Linker
You may need to clear the browser cache. It is possible that the compiled js that the browser is using is not the js that has most recently been compiled.
In Chrome you can see if the cached js is being used in the developer tools windows (ctrl + shift + i). In the size column it will say (from cache) instead of the actual size. You can then right click and clear the browser cache. ctrl + r to reload and the error should be gone.
Carl Smotricz is absolutely right.
Just Cleaning and Build Project on the topmost menu doesn't work.
You must use "Google | GWT Compile" on the context menu generated when right-clicking on your GWT project, prior to deployment.
The error may not be about not-adding "?gwt.codesvr=127.0.0.1:9997" at the end of host web page if he or she tried to deploy the GWT-based webapp on WAS external to Eclipse.
Server restart did the job for me.
I had tried clearing cache, clean and rebuild .. but i was still getting the same warning message.
Server restart made it reload all the stull from the latest compiled war.
It was a hit and trial and i am glad it worked :) :)