CSRF issues with serving global JS files

[joehobson]

I run an open source (self-hosted) Canvas system deployed on two front-end servers through a load balancer. I'd like to use global js and css files (styling, Google Analytics tracking, etc). After I add a global JS file in the theme editor, I get a 422 error in my browser console when loading a page (for /accounts/1/files/12345/download?verifier=<redacted>). The canvas log shows this error:

ActionController::InvalidCrossOriginRequest (Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.): 

/var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.0.2/lib/action_controller/metal/request_forgery_protection.rb:239:in `verify_same_origin_request'

Anything special I need to do in Canvas or my nginx or load balancer configs to make it all happy? I'd like to avoid disabling forgery protection. I am not using a files_domain or S3 file hosting.

Thanks! ... .joe

[huangdengpan]

I need to share some javascripts to students, but it shew 422 errors. Does anyone could help us ?Thank you!

[huangdengpan]

I uploaded xxx.js files to the course, it cannot be download.

[James]

 @huangdengpan  ,

This is a completely different issue than the thread you attached it to, so people may not see it. Especially since the original one went unanswered for six months.

What you're experiencing is by design for security purposes. You cannot upload JavaScript files to the course with an extension that the browser would interpret as JavaScript and try to execute.

Depending on what you want students to do with it, consider hosting it on another site and then either embedding that page within Canvas (so that it's inside the iframe sandbox that gets created when you embed content) or -- if you want them to view it but not execute it -- then change the extension to txt. If it's okay to share outside of a course, you could use one of the many code sharings sites (like codepen -- not an endorsement) and then link to it. That would give them the benefit of being able to play around with it and seeing it in action.

Again, all of that depends on what you want to do with the JavaScript. But having the ability to upload JavaScript and automatically run it is bad security. A student could easily upload JavaScript for an assignment and you could open it and then, acting as you, it makes API calls that on your behalf that do bad things like change grades, delete assignments, reset the course, etc.

[ProfessorBeyrer]

I like the option to change the file extension. I also advise faculty teaching JavaScript to wrap those files into a .zip file. 

[huangdengpan]

Good idea. Thank you1

[stuart_ryan]

Hi joehobson‌,

I see there has been some recent activity on your question (though unrelated). I would like to follow up and see if you were ever able to get this fixed or workaround the issue? Or is this still something potentially outstanding?

Look forward to hearing from you.

Cheers,
Stuart

[joehobson · Accepted solution]

Hi  @stuart_ryan ‌,

Yes, the original issue has been fixed - Exempt files#show_relative from protect_from_forgery by grahamb · Pull Request #945 · instructure/ca... 

thanks for checking the status. ... .joe

[stuart_ryan]

Hi joehobson‌,

That is great thank you so much for letting us know and sharing the fix!

Cheers,
Stuart