Packagist: resources not loaded due to content-security policy

[Lewiscowles1986]

It's not a big issue, but images linked in GitHub readme files don't load giving a console error

rfc1867:1 Refused to load the image 'https://raw.github.com/Lewiscowles1986/rfc1867/HEAD/diagram/class-relationship.png?raw=true' because it violates the following Content Security Policy directive: "img-src 'self' https://www.gravatar.com/ https://camo.githubusercontent.com/ https://ssl.google-analytics.com/ http://www.google-analytics.com/".

[spmsupun]

Any updates on that ?

[Lewiscowles1986]

still the case for me I'm afraid.

[spmsupun]

Use imgur.com

[Lewiscowles1986]

If that's honestly your only input you don't understand the problem...

[spmsupun]

😄 I've uploaded my image image imgur.com and used its as <img src="https://i.imgur.com/hGzLkvc.png">
then github automatically convert it into anonymized image URLs (https://help.github.com/articles/about-anonymized-image-urls/) then your image look like that: <img src="https://camo.githubusercontent.com/6f3973f2f4430adeb221a142f0977a1f5e90f25d/68747470733a2f2f692e696d6775722e636f6d2f68477a4c6b76632e706e67" data-canonical-src="https://i.imgur.com/hGzLkvc.png" style="max-width:100%;">

When you use github raw data, github doesn't convert your image to camo.
About fonts, I don't think you can use in packagist

[Lewiscowles1986]

I'm not using fonts (that's packagist). The images are linked to the repo for a reason. If you know of a script to POST to imgur API and rewrite using sed before commit, I'm all ears, but the problem as I understand it is that the CSP is too strict. (What's wrong with raw git urls?)

[spmsupun]

look at the error messages, you can only use few providers for image.

[stof]

Regarding the font loaded as a data URL (and blocked because of that), this is weird as I cannot reproduce the issue. Can you give more details about which page is triggering this and details about your environment (browser, version of the browser, OS, ...) ?

[Lewiscowles1986]

Sure, Chrome on Linux 64-bit

I'm also not getting for fonts in Firefox. weird...

[stof]

Using Chromium on Ubuntu, I'm not getting these issues either for the font

[Lewiscowles1986]

I've searched ~/.config/google-chrome/Default using grep -rl $data-uri. Looks like it's Grammarly extension making the font errors :blush: The image problem should be fixed when #885 gets merged.

[ghost]

Hi,

I'm having the same problem with README.md from a repository in GitLab. The links of the images are from my site and also the badges of Shields.io.

Any ideas or suggestions?

[stof]

@arcanck can you give the link to you package ?

[ghost]

@stof, the link to my package is this.

[Lewiscowles1986]

:laughing: :rofl: still doesn't load my package images and I'm the one that raised the issue...

[Lewiscowles1986]

Doesn't load @arcanck linked above either

[Seldaek]

The fix at https://github.com/composer/packagist/pull/891 was missnig a / in the URL, so it failed. Just deployed another fix now.