microsoft / microsoft/AdaptiveCards

[Designer] Adaptive Cards Editor samples are empty because of Content Seurity Policy

Open
#8,966 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area-Designer Bug
Dominant language
C#
Stars
2k
Forks
595
Avg merge
1d 19h
Merged PRs (30d)
1

Description

Problem Description

In the Developer Portal's Adaptive Cards Editor: https://dev.teams.microsoft.com/cards/new -- nothing loads in the Pick a sample as a starting point window, opening the Network trace, you will see hundreds of the following errors:

Refused to load the font '<URL>' because it violates the following Content Security Policy directive: "font-src data: *.sharepointonline.com *.akamaihd.net *.microsoft.com"

Refused to connect to 'https://raw.githubusercontent.com/OfficeDev/Microsoft-Teams-Card-Samples/main/samples/catalog.json' because it violates the following Content Security Policy directive: "connect-src *.office.net *.microsoft.com *.office.com *.microsoftonline.com *.office365.com *.msecnd.net *.live.com"

15.4cfd06ca.chunk.js:2 Refused to connect to 'https://raw.githubusercontent.com/OfficeDev/Microsoft-Teams-Card-Samples/main/samples/catalog.json' because it violates the following Content Security Policy directive: "connect-src *.office.net *.microsoft.com *.office.com *.microsoftonline.com *.office365.com *.msecnd.net *.live.com minimavenautosuggestppe.search.windows.net minimavenautosuggest.search.windows.net blob:"

CSP FAIL

Card JSON
{
"N/A": "N/A"
}
Screenshot

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the Developer Portal's Adaptive Cards Editor at https://dev.teams.microsoft.com/cards/new and reproduce the empty sample window while reviewing the Network trace. Inspect the Content Security Policy violations for the font requests and the catalog.json fetch from raw.githubusercontent.com; done means the samples load without CSP errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend, security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.