Avoid false green framework CSP checks by EugeniyKiyashko · Pull Request #33728 · DevExpress/DevExtreme

EugeniyKiyashko · 2026-05-26T14:38:08Z

No description provided.

Copilot

Pull request overview

Updates the demos CSP validation pipeline to avoid “false green” results by checking production-style (bundled) pages for React/Vue/Angular, tightening per-framework CSP allowlists, and improving CSP-check robustness.

Changes:

Add demo pre-bundling for CSP checks (esbuild for React/Vue; Angular AOT bundling via @angular/build/private) and route CSP checks to apps/demos/csp-bundled-demos.
Refactor CSP server directives/allowlists to distinguish SystemJS dev needs vs bundled needs; add Angular ngCspNonce stamping for bundled demos.
Clean up multiple Angular demo sources to remove unnecessary $event bindings, fix template binding typos, and remove inline styles/external font dependency that can affect CSP.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/devextreme-scss/scss/widgets/generic/treeView/_index.scss	Removes an unused SCSS `@use` import to reduce redundant dependencies.
apps/demos/utils/server/tsconfig.csp-bundle-angular.json	Adds a dedicated TS config used by the Angular CSP bundler.
apps/demos/utils/server/csp-server.js	Splits CSP behavior between SystemJS dev vs bundled demos; switches to report-only header and adds Angular nonce stamping for styles.
apps/demos/utils/server/csp-check.js	Reworks CSP checking to use a single CDP-driven Chrome instance and in-page violation capture; adds bundling mode + sharding support.
apps/demos/utils/server/csp-bundle.js	New: bundles React/Vue demos into production-style pages for CSP validation.
apps/demos/utils/server/csp-bundle-angular.js	New: bundles Angular demos (AOT) into production-style pages for CSP validation, with sharding and patch/shim helpers.
apps/demos/Demos/TreeView/ItemSelectionAndCustomization/Angular/app/app.component.ts	Removes `BrowserModule` from standalone imports for CSP-friendly bundling.
apps/demos/Demos/TreeList/MultipleRowSelection/Angular/app/app.component.html	Drops unused `$event` parameter from option change handlers.
apps/demos/Demos/TreeList/CustomizeKeyboardNavigation/Angular/app/app.component.html	Fixes a casing typo in `editOnKeyPress` binding.
apps/demos/Demos/Stepper/FormIntegration/Angular/app/app.component.html	Drops unused `$event` parameter from button click handlers.
apps/demos/Demos/SpeechToText/Overview/Angular/app/app.component.html	Drops unused `$event` parameter from button click handler.
apps/demos/Demos/Scheduler/DragAndDrop/Angular/app/app.component.html	Fixes `@for ... track` expression to use an existing stable field.
apps/demos/Demos/Localization/UsingIntl/Angular/app/app.component.html	Fixes `applyFilter` binding to use a string literal instead of an undefined identifier.
apps/demos/Demos/Localization/UsingGlobalize/Angular/app/app.component.html	Fixes `applyFilter` binding to use a string literal instead of an undefined identifier.
apps/demos/Demos/LoadIndicator/Overview/Angular/app/app.component.html	Drops unused `$event` parameter and collapses markup to avoid unnecessary inline patterns.
apps/demos/Demos/List/Selection/Angular/app/app.component.ts	Removes `BrowserModule` from standalone imports for CSP-friendly bundling.
apps/demos/Demos/Form/ItemCustomization/Angular/app/app.component.ts	Tightens template-related typing (array element shape) for consistency under AOT/bundling.
apps/demos/Demos/Form/Grouping/Angular/app/app.component.ts	Tightens template-related typing (array element shape) for consistency under AOT/bundling.
apps/demos/Demos/FilterBuilder/Customization/Angular/app/app.component.ts	Removes `BrowserModule` from standalone imports for CSP-friendly bundling.
apps/demos/Demos/FileUploader/ChunkUpload/Angular/app/app.component.html	Drops unused `$event` parameter from upload started handler.
apps/demos/Demos/Drawer/TopOrBottomPosition/Angular/index.html	Removes external Font Awesome stylesheet to reduce CSP exceptions.
apps/demos/Demos/Drawer/LeftOrRightPosition/Angular/index.html	Removes external Font Awesome stylesheet to reduce CSP exceptions.
apps/demos/Demos/Drawer/LeftOrRightPosition/Angular/app/app.component.html	Replaces inline style with a CSS class to avoid inline-style CSP violations.
apps/demos/Demos/Drawer/LeftOrRightPosition/Angular/app/app.component.css	Adds styling for the new drawer panel class (keeps styles out of inline attributes).
apps/demos/Demos/DataGrid/NewRecordPosition/Angular/app/app.component.ts	Removes `BrowserModule` from standalone imports for CSP-friendly bundling.
apps/demos/Demos/DataGrid/CustomizeKeyboardNavigation/Angular/app/app.component.html	Fixes a casing typo in `editOnKeyPress` binding.
apps/demos/Demos/Chat/MessageEditing/Angular/app/app.component.html	Fixes a binding typo (`allowEditingLabel`).
apps/demos/Demos/Charts/TilingAlgorithms/Angular/app/app.component.ts	Removes `BrowserModule` from standalone imports for CSP-friendly bundling.
apps/demos/Demos/Charts/CenterLabelCustomization/Angular/app/app.component.html	Replaces inline SVG styling with CSS classes to avoid inline-style CSP violations.
apps/demos/Demos/Charts/CenterLabelCustomization/Angular/app/app.component.css	Adds CSS for the new SVG label classes.
apps/demos/Demos/Charts/AreaSelectionZooming/Angular/app/app.component.html	Drops unused `$event` parameter and collapses markup for CSP-friendly bundling.
apps/demos/Demos/ActionSheet/PopoverMode/Angular/app/app.component.html	Fixes `@for ... track` expression to use an existing stable field.
apps/demos/.gitignore	Ignores `csp-bundled-demos` output and Angular bundler scratch artifacts.
.github/workflows/visual-tests-demos.yml	Enables bundling + sharding for CSP checks in CI and adjusts artifact naming accordingly.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: EugeniyKiyashko <EugeniyKiyashko@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 2 comments.

+  await startBrowser();

-  const reportFile = join(REPORT_DIR, `csp-violations-${FRAMEWORK.toLowerCase()}.jsonl`);
+  try {
+    await runPool(demos, CONCURRENCY, async (demo, i) => {
+      const idx = i + 1;


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: EugeniyKiyashko <EugeniyKiyashko@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 2 comments.


 const CHROME_PATH = findChrome();

+const DEBUG_PORT = 20222;


+const CHROME_USER_DATA_DIR = process.env.CSP_CHROME_USER_DATA_DIR
+  || join(os.tmpdir(), 'csp-chrome-shared');
+const CHROME_DISK_CACHE_DIR = process.env.CSP_CHROME_DISK_CACHE_DIR
+  || join(os.tmpdir(), 'csp-chrome-cache');


EugeniyKiyashko self-assigned this May 26, 2026

EugeniyKiyashko added force all tests 26_1 labels May 26, 2026

EugeniyKiyashko force-pushed the 26_1_revert branch 27 times, most recently from 9062a70 to 4a8d49c Compare June 2, 2026 14:31

EugeniyKiyashko force-pushed the 26_1_revert branch 4 times, most recently from ca9065f to 8e9fa18 Compare June 2, 2026 16:52

EugeniyKiyashko changed the title ~~Test CI~~ Repair framework CSP checks Jun 2, 2026

EugeniyKiyashko force-pushed the 26_1_revert branch 2 times, most recently from 26bbe83 to 5d4c06b Compare June 2, 2026 18:47

repair CSP checks in Frameworks

3027521

EugeniyKiyashko force-pushed the 26_1_revert branch from 5d4c06b to 3027521 Compare June 2, 2026 19:54

EugeniyKiyashko changed the title ~~Repair framework CSP checks~~ Avoid false green framework CSP checks Jun 3, 2026

EugeniyKiyashko marked this pull request as ready for review June 3, 2026 05:32

Copilot AI review requested due to automatic review settings June 3, 2026 05:32

EugeniyKiyashko requested review from a team as code owners June 3, 2026 05:32

Copilot started reviewing on behalf of EugeniyKiyashko June 3, 2026 05:32 View session

Copilot AI reviewed Jun 3, 2026

View reviewed changes

Comment thread apps/demos/utils/server/csp-check.js

dmlvr previously approved these changes Jun 3, 2026

View reviewed changes

Potential fix for pull request finding

6694fa9

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: EugeniyKiyashko <EugeniyKiyashko@users.noreply.github.com>

EugeniyKiyashko dismissed dmlvr’s stale review via 6694fa9 June 3, 2026 08:58

Copilot AI review requested due to automatic review settings June 3, 2026 08:58

Copilot started reviewing on behalf of EugeniyKiyashko June 3, 2026 08:59 View session

Copilot AI reviewed Jun 3, 2026

View reviewed changes

Potential fix for pull request finding

84a62d3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: EugeniyKiyashko <EugeniyKiyashko@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 3, 2026 09:10

Copilot started reviewing on behalf of EugeniyKiyashko June 3, 2026 09:11 View session

Copilot AI mentioned this pull request Jun 3, 2026

Ensure CSP check always tears down Chrome when startup fails #33816

Closed

Copilot AI reviewed Jun 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Avoid false green framework CSP checks#33728

Avoid false green framework CSP checks#33728
EugeniyKiyashko wants to merge 3 commits into
DevExpress:26_1from
EugeniyKiyashko:26_1_revert

EugeniyKiyashko commented May 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

EugeniyKiyashko commented May 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants