[release-4.22] OCPBUGS-122042: Strip existing OCI tag before appending new version + fix CSP violation crash by sowmya-sl · Pull Request #17345 · openshift/console

sowmya-sl · 2026-10-01T11:35:00Z

Supersedes #17155, which includes this PR's commits plus a fix for an unrelated CSP-violation crash (Failed to construct 'URL': Invalid URL in useCSPViolationDetector) that was causing the helm-release.feature e2e failures seen in #17155's CI run.

openshift-merge-bot · 2026-10-01T11:35:02Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-10-01T11:35:06Z

@sowmya-sl: This pull request references Jira Issue OCPBUGS-105603, which is invalid:

expected the bug to target only the "4.22.0" version, but multiple target versions were set
expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Verified instead
expected Jira Issue OCPBUGS-105603 to depend on a bug targeting a version in 5.0.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

useCSPViolationDetector's sameHostname() called new URL() on SecurityPolicyViolationEvent.blockedURI/sourceFile without handling the case where these are non-absolute-URL tokens such as "inline", "eval", or an empty string (which the spec explicitly allows). This threw an uncaught TypeError: Failed to construct 'URL': Invalid URL, crashing the entire React tree.

How this was found

While investigating e2e CI failures on helm-release.feature surfaced in #17155, nearly every failing test in that spec showed the same uncaught exception, followed by unrelated-looking timeouts (DataViewFilters never found, topology empty state stuck, disabled filter input, etc.). All of these were downstream symptoms of this single crash: the Helm Form View install page triggers an inline-style CSP violation, which gets compared against cached violations via sameHostname(), which throws and kills the app mid-test.

This fix itself is unrelated to the OCI chart URL changes in #17155 — it's a separate, pre-existing bug in CSP violation handling that CI happened to surface while testing that PR.

This same fix already exists on main (landed via #17010, "Migrate OLM Cypress tests to Playwright") but hadn't been backported to release-4.22 yet.

Fix

Wrap the new URL() calls in try/catch, returning false for non-URL tokens instead of throwing. Exported sameHostname and added direct unit test coverage for "inline", "eval", and empty-string inputs.

Testing

Added Jest coverage in useCSPViolationDetector.spec.tsx (10/10 passing); verified these tests fail without the fix and pass with it.

yarn eslint clean on changed files.

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Make getFullChartURL idempotent by stripping any existing version tag before appending, so URLs like oci://registry/chart:1.0.0 don't become chart:1.0.0:1.0.0. Move version stripping out of the useEffect in HelmURLChartForm to avoid mutating the URL field while the user types.

Use a case-insensitive regex for the OCI scheme check so uppercase or mixed-case OCI URLs (e.g. OCI://registry/chart) are handled correctly when appending the version tag. Co-authored-by: Cursor <cursoragent@cursor.com>

…-reappend Only append the version tag when it's not already present, rather than stripping and re-adding it. Combines all conditions into a single ternary expression per review feedback. Co-authored-by: Cursor <cursoragent@cursor.com>

Replace any existing tag in the OCI URL before appending chartVersion, so changing the version from 1.0.0 to 2.0.0 produces chart:2.0.0 instead of chart:1.0.0:2.0.0. Registry ports are preserved since the regex only matches the last colon with no trailing slashes. Co-authored-by: Cursor <cursoragent@cursor.com>

sowmya-sl · 2026-10-01T12:09:29Z

/retest

webbnh

/lgtm

One question: it doesn't look like all of these changes (e.g., the tests) are in main...do you have a plan for getting them there?

openshift-merge-bot · 2026-10-02T17:27:32Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console

openshift-ci-robot · 2026-10-05T07:24:51Z

@sowmya-sl: This pull request references Jira Issue OCPBUGS-122042, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-105603 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-105603 targets the "5.0.0" version, which is one of the valid target versions: 5.0.0
bug has dependents

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Supersedes #17155, which includes this PR's commits plus a fix for an unrelated CSP-violation crash (Failed to construct 'URL': Invalid URL in useCSPViolationDetector) that was causing the helm-release.feature e2e failures seen in #17155's CI run.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

SecurityPolicyViolationEvent.blockedURI (and sourceFile) are not always absolute URLs; they can be tokens such as "inline", "eval", or an empty string. useCSPViolationDetector's sameHostname() called new URL() on these values without handling that case, throwing an uncaught "Failed to construct 'URL': Invalid URL" TypeError that crashed the whole React tree. This was discovered while investigating e2e CI failures on helm-release.feature in openshift#17155: the Helm Form View install page triggers an inline-style CSP violation, which hits this code path and crashes the app, cascading into unrelated timeouts (DataViewFilters, topology empty state, etc.) across the rest of that spec file. Wrap the URL parsing in try/catch and return false for non-URL tokens instead of throwing. Export sameHostname and add direct unit test coverage for the previously-unhandled token values. Co-authored-by: Cursor <cursoragent@cursor.com>

sowmya-sl · 2026-10-05T08:32:42Z

/test backend

sowmya-sl · 2026-10-05T08:45:08Z

/verified by @sowmya-sl

openshift-ci-robot · 2026-10-05T08:45:21Z

@sowmya-sl: This PR has been marked as verified by @sowmya-sl.

Details

In response to this:

/verified by @sowmya-sl

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jhadvig · 2026-10-05T09:46:17Z

/pipeline required

openshift-merge-bot · 2026-10-05T09:46:30Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console

jhadvig

/lgtm
/approve

openshift-merge-bot · 2026-10-05T09:47:07Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console

openshift-ci · 2026-10-05T09:47:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhadvig, sowmya-sl, webbnh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~frontend/OWNERS~~ [jhadvig]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-10-05T13:09:20Z

@sowmya-sl: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jhadvig · 2026-10-05T14:20:19Z

/label backport-risk-assessed

openshift-ci-robot · 2026-10-05T14:30:27Z

@sowmya-sl: Jira Issue Verification Checks: Jira Issue OCPBUGS-122042
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-122042 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Supersedes #17155, which includes this PR's commits plus a fix for an unrelated CSP-violation crash (Failed to construct 'URL': Invalid URL in useCSPViolationDetector) that was causing the helm-release.feature e2e failures seen in #17155's CI run.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2026-10-06T18:41:46Z

Fix included in release 4.22.0-0.nightly-2026-10-06-081053

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 1, 2026

openshift-ci Bot requested review from Leo6Leo and jhadvig October 1, 2026 11:35

openshift-ci Bot added the component/core Related to console core functionality label Oct 1, 2026

sowmya-sl and others added 4 commits October 1, 2026 17:13

sowmya-sl force-pushed the OCPBUGS-105603-csp-violation-invalid-url-crash branch from 861c839 to 7126dc6 Compare October 1, 2026 11:44

sowmya-sl changed the title ~~OCPBUGS-105603: Guard sameHostname against non-URL CSP violation tokens~~ OCPBUGS-105603: Strip existing OCI tag before appending new version + fix CSP violation crash Oct 1, 2026

sowmya-sl mentioned this pull request Oct 1, 2026

[release-4.22] OCPBUGS-122042: Strip version tag from OCI chart URL to prevent doubl… #17155

Closed

openshift-ci Bot added the component/helm Related to helm-plugin label Oct 1, 2026

webbnh approved these changes Oct 2, 2026

View reviewed changes

openshift-ci Bot assigned webbnh Oct 2, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Oct 2, 2026

sowmya-sl changed the title ~~OCPBUGS-105603: Strip existing OCI tag before appending new version + fix CSP violation crash~~ [release-4.22] OCPBUGS-122042: Strip existing OCI tag before appending new version + fix CSP violation crash Oct 5, 2026

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 5, 2026

sowmya-sl force-pushed the OCPBUGS-105603-csp-violation-invalid-url-crash branch from 7126dc6 to 9343ca7 Compare October 5, 2026 07:59

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 5, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Oct 5, 2026

jhadvig approved these changes Oct 5, 2026

View reviewed changes

openshift-ci Bot assigned jhadvig Oct 5, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Oct 5, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 5, 2026

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Oct 5, 2026

openshift-merge-bot Bot merged commit 06881d2 into openshift:release-4.22 Oct 5, 2026
8 checks passed

Conversation

sowmya-sl commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Oct 1, 2026

Uh oh!

openshift-ci-robot commented Oct 1, 2026

Summary

How this was found

Fix

Testing

Uh oh!

sowmya-sl commented Oct 1, 2026

Uh oh!

webbnh left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Oct 2, 2026

Uh oh!

openshift-ci-robot commented Oct 5, 2026

Uh oh!

sowmya-sl commented Oct 5, 2026

Uh oh!

sowmya-sl commented Oct 5, 2026

Uh oh!

openshift-ci-robot commented Oct 5, 2026

Uh oh!

jhadvig commented Oct 5, 2026

Uh oh!

openshift-merge-bot Bot commented Oct 5, 2026

Uh oh!

jhadvig left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Oct 5, 2026

Uh oh!

openshift-ci Bot commented Oct 5, 2026

Uh oh!

openshift-ci Bot commented Oct 5, 2026

Uh oh!

jhadvig commented Oct 5, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 5, 2026

Uh oh!

openshift-merge-robot commented Oct 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sowmya-sl commented Oct 1, 2026 •

edited

Loading