IOU - Mapbox "Refused to load the script" console errors when Clicking on Submit expense

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!

---

Version Number: 1.4.80-6
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: N/A
Issue reported by: Applause - internal Team

Issue found when executing PR #42737

Action Performed:

1. Log in with an expensifail account
2. Open the Chrome console
3. Navigate to FAB - Start chat
4. Enter an existing Gmail account
5. Click on the "+" button and Submit expense

Expected Result:

There shouldn't be any console errors-

Actual Result:

2 "Refused to load the script" and a "NetworkError: Failed to execute 'importScripts'" console errors appear right when clicking on Submit expense button

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6504331_1717703821734.bandicam_2024-06-06_21-48-11-743.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @johncschuster (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[lanitochka17]

@johncschuster FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors

[MonilBhavsar]

Looking as it is coming from #42737

[MonilBhavsar]

This does seem like a network issue where we could not load mapbox library. @lanitochka17 could you please retry, thanks!

[MelvinBot]

This has been labelled "Needs Reproduction". Follow the steps here: https://stackoverflowteams.com/c/expensify/questions/16989

[MonilBhavsar]

I see when using a very new gmail account. Looking...

[MonilBhavsar]

@neil-marcellini or @hayata-suenaga any one of you know of a recent change that would have caused this.
I see CSP for mapbox was introduced in the PR https://github.com/Expensify/Cloudflare-Workers/pull/82
I don't see nay recent change though

[hayata-suenaga]

It appears to be a CORS error. If I remember correctly, the CORS policy is set in the Salt repository, and this issue might stem from a recent change there.

I haven't been invovled in the distance request development since last summer, so I haven't made any recent changes to the code related to this.

[MonilBhavsar]

Thanks Hayata! Will take a look at the recent Salt PR's

[MonilBhavsar]

This is the error we're getting -

4dd3b60c-99a7-48df-9185-db955ed683c8:1 Refused to load the script 'https://api.mapbox.com/mapbox-gl-js/plugins/mapbox-gl-rtl-text/v0.2.3/mapbox-gl-rtl-text.js' because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-MGU0MDMxMDdmMD/MDhjMDY3MDNmMDkxMDQwMDllMGIz' 'unsafe-eval' https://polyfill.io https://cdn.plaid.com https://www.woopra.com https://assets.onfido.com https://sdk.onfido.com https://sentry.io https://*.sardine.ai/ https://appleid.cdn-apple.com https://www.googletagmanager.com https://web-sdk.smartlook.com https://edge.fullstory.com https://rs.fullstory.com https://accounts.google.com/gsi/client". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

I think error is referring to this block where there is no mapbox domain - https://api.mapbox.com
https://github.com/Expensify/Cloudflare-Workers/blob/d905d45425aa55abf2037da0a426dbe785036c84/new.expensify.com/wrangler.toml#L26-L40

May be we need to add it to the list. I am not completely sure about it though

[MonilBhavsar]

Will take a look at the recent Salt PR's

Couldn't see a recent change there

[MonilBhavsar]

I have submitted a PR that will fix this issue

[MonilBhavsar]

We need to deploy CF change

[johncschuster]

It doesn't look like any external contributors were involved in the linked PR. Were there any contributions I'm unaware of that require payment, @MonilBhavsar?

[MonilBhavsar]

All internal, no payment required here

[MonilBhavsar]

@Beamanator is helping with the deploy 🚀

[Beamanator]

Done! Changes should be on staging. Let me know if / when you want me to deploy them to prod

[MonilBhavsar]

No console error on staging. let's ship it to production

[Beamanator]

Nice, shipping

[Beamanator]

Deployed 👍

[MonilBhavsar]

Confirmed on production too. Thank you 🙇