[FEAT/FIX]: Core/Report - CSP Refactoring (garris#1171)

[dgrebb]

Problem

Content-Security-Policy is beginning to grow in popularity, and CSS/Script injections will increasingly be blocked.

This applies to:

• frame-src: report viewing inside frames in CI/CD like Jenkins (Jenkins "HTML report" page is blank garris/BackstopJS#1171)
• style-src: injecting styles and inline styles in HTML Report
• script-src: injecting scripts and inline scripts in HTML Report

Solution

• do more research into CSP thread: Page with CSP breaks puppeteer puppeteer/puppeteer#1229 (comment)
• design feature implementations
  • create a loader for Report
  • create a loader for test injection (unique to Playwright/Puppeteer?)

Puppeteer

• https://pptr.dev/api/puppeteer.page.setbypasscsp/

Important

CSP bypassing happens at the moment of CSP initialization rather than evaluation. Usually, this means that page.setBypassCSP should be called before navigating to the domain.

Playwright

• https://playwright.dev/docs/api/class-testoptions#test-options-bypass-csp
• we likely want this: https://playwright.dev/docs/api/class-browser