capture basic csp info

metal-messiah · metal-messiah · commit 2be861077164 · 2025-08-14T12:58:25.000-06:00
diff --git a/src/features/jserrors/instrument/index.js b/src/features/jserrors/instrument/index.js
@@ -47,6 +47,11 @@ export class Instrument extends InstrumentBase {
       handle('err', [castErrorEvent(errorEvent), now(), false, {}, agentRef.runtime.isRecording], undefined, this.featureName, this.ee)
     }, eventListenerOpts(false, this.removeOnAbort?.signal))
 
+    globalScope.addEventListener('securitypolicyviolation', (violationEvent) => {
+      if (!this.abortHandler) return
+      handle('err', [castErrorEvent(violationEvent), now(), false, { cspViolation: 1 }, agentRef.runtime.isRecording], undefined, this.featureName, this.ee)
+    })
+
     this.abortHandler = this.#abort // we also use this as a flag to denote that the feature is active or on and handling errors
     this.importAggregator(agentRef, () => import(/* webpackChunkName: "jserrors-aggregate" */ '../aggregate'))
   }
diff --git a/src/features/jserrors/shared/cast-error.js b/src/features/jserrors/shared/cast-error.js
@@ -70,6 +70,12 @@ export function castErrorEvent (errorEvent) {
     error.name = SyntaxError.name
     return error
   }
+  /** SecurityPolicyViolationEvent does not exist in safari workers */
+  if (typeof SecurityPolicyViolationEvent !== 'undefined' && errorEvent instanceof SecurityPolicyViolationEvent) {
+    const error = new UncaughtError(errorEvent.violatedDirective, errorEvent.sourceFile, errorEvent.lineNumber, errorEvent.columnNumber, undefined, `violation of disposition: "${errorEvent.disposition}" of original policy: "${errorEvent.originalPolicy}"`)
+    error.name = 'ContentSecurityPolicyViolation'
+    return error
+  }
   if (canTrustError(errorEvent.error)) return errorEvent.error
   return castError(errorEvent)
 }
diff --git a/src/features/jserrors/shared/uncaught-error.js b/src/features/jserrors/shared/uncaught-error.js
@@ -11,12 +11,13 @@ import { stringify } from '../../../common/util/stringify'
  * do not use the Error class (strings, etc) to an object.
  */
 export class UncaughtError {
-  constructor (message, filename, lineno, colno, newrelic) {
+  constructor (message, filename, lineno, colno, newrelic, cause) {
     this.name = 'UncaughtError'
     this.message = typeof message === 'string' ? message : stringify(message)
     this.sourceURL = filename
     this.line = lineno
     this.column = colno
     this.__newrelic = newrelic
+    this.cause = cause
   }
 }
diff --git a/tests/assets/csp-violation.html b/tests/assets/csp-violation.html
@@ -6,15 +6,25 @@
 <html>
   <head>
     <title>RUM Unit Test</title>
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'; connect-src *;">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'; connect-src *;" />
     {init} {config} {loader}
   </head>
-  <body>Instrumented
+  <body>
+    Instrumented
     <script>
+      document.addEventListener("securitypolicyviolation", function (event) {
+        console.log("CSP Violation:", event);
+
+        // Use event metadata to form a "stack trace"-like string
+        const stackTrace = [`Blocked URI: ${event.blockedURI}`, `Violated Directive: ${event.violatedDirective}`, `Source File: ${event.sourceFile}`, `Line: ${event.lineNumber}`, `Column: ${event.columnNumber}`, `Disposition: ${event.disposition}`].join("\n");
+        console.log("CSP Violation metadata as stack trace:\n" + stackTrace);
+      });
+
       // This script will trigger a CSP violation
-      var script = document.createElement('script');
-      script.src = 'https://example.com';
+      var script = document.createElement("script");
+      script.src = "https://example.com";
       document.body.appendChild(script);
     </script>
+    <script src="./js/csp.js"></script>
   </body>
 </html>
diff --git a/tests/assets/js/csp.js b/tests/assets/js/csp.js
@@ -0,0 +1,4 @@
+// This script will trigger a CSP violation
+var script = document.createElement('script')
+script.src = 'https://example.com'
+document.body.appendChild(script)

Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,12 @@ export function castErrorEvent (errorEvent) {`
`70`	`70`	`error.name = SyntaxError.name`
`71`	`71`	`return error`
`72`	`72`	`}`
	`73`	`+ /** SecurityPolicyViolationEvent does not exist in safari workers */`
	`74`	`+ if (typeof SecurityPolicyViolationEvent !== 'undefined' && errorEvent instanceof SecurityPolicyViolationEvent) {`
	`75`	+ const error = new UncaughtError(errorEvent.violatedDirective, errorEvent.sourceFile, errorEvent.lineNumber, errorEvent.columnNumber, undefined, `violation of disposition: "${errorEvent.disposition}" of original policy: "${errorEvent.originalPolicy}"`)
	`76`	`+ error.name = 'ContentSecurityPolicyViolation'`
	`77`	`+ return error`
	`78`	`+ }`
`73`	`79`	`if (canTrustError(errorEvent.error)) return errorEvent.error`
`74`	`80`	`return castError(errorEvent)`
`75`	`81`	`}`