From 7193837503d3771fad8b2fd77e3067447f9c3628 Mon Sep 17 00:00:00 2001 From: Boris Tyshkevich Date: Thu, 30 Jul 2026 15:37:36 +0200 Subject: [PATCH] fix(deploy): allow any HTTPS host on sql.demo.altinity.cloud's connect-src MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The demo release's connect-src was bounded to a fixed 4-origin allowlist (the chart default), so "Advanced — connect to another server" against any other ClickHouse host was silently blocked by CSP and surfaced as a bare "Failed to fetch" with no indication the request never left the browser. This shared instance is used ad hoc against arbitrary clusters, so its values-demo.yaml override now sets connectSrc to the "https:" scheme-source instead of inheriting the fixed list. The chart's own secure-by-default is unchanged for every other install. Closes-context: #575 (follow-up UX gap, filed separately) Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KWApnNReVKwis3HdFfeUga --- CHANGELOG.md | 13 +++++++++++++ deploy/helm/values-demo.yaml | 22 ++++++++++++++++++++-- 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 91943d6a..641a94a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -81,6 +81,19 @@ auto-generated per-PR notes; this file is the curated, human-readable history. adapter refactor — no user-visible behavior changes. ### Fixed +- **`sql.demo.altinity.cloud` couldn't reach any host via "Advanced — connect to + another server."** The chart-default `connectSrc` bounds CSP `connect-src` to + a fixed 4-origin allowlist (README.md/docs/DEPLOYMENT.md's documented + security posture — same origins as `config.hosts`), so typing any other + ClickHouse host into the Advanced field was silently refused by the browser + with a bare "Failed to fetch" (no CSP-violation surfaced anywhere in the UI — + tracked separately as a UX gap, #575). This shared instance is used ad hoc + against arbitrary clusters, so `deploy/helm/values-demo.yaml` now overrides + `connectSrc: "https:"` (any HTTPS origin) instead of inheriting the fixed + allowlist. The chart's own default in `helm/altinity-sql-browser/values.yaml` + is unchanged — this only loosens the one shared demo release, trading away + its origin-allowlist defense-in-depth for the ability to point it at any + cluster. - **A corrupt `asb:sidePanel` decodes to the Library instead of propagating** (#487). The lower pane's active section was read from localStorage undecoded, and every reader compared `=== 'saved'`, so an unrecognized or obsolete value diff --git a/deploy/helm/values-demo.yaml b/deploy/helm/values-demo.yaml index 7bd4ad7c..c0a7c485 100644 --- a/deploy/helm/values-demo.yaml +++ b/deploy/helm/values-demo.yaml @@ -5,13 +5,31 @@ # helm upgrade --install sql-browser helm/altinity-sql-browser \ # -n demo -f deploy/helm/values-demo.yaml # -# connectSrc + config inherit the 4-entry public-demo defaults from values.yaml -# (antalya + github.demo, each in demo:demo and Google-SSO modes). +# config inherits the 4-entry public-demo defaults from values.yaml (antalya + +# github.demo, each in demo:demo and Google-SSO modes) — those are just the +# login-picker shortcuts. connectSrc is overridden below: this instance is +# used ad hoc (via "Advanced — connect to another server") against ClickHouse +# hosts that aren't known in advance, so it can't be pinned to a fixed origin +# list the way values.yaml's chart default documents for other installs. image: # Pinned to the v0.6.4 release image for reproducibility. tag: "0.6.4" +# Chart default (values.yaml) bounds connect-src to a fixed origin allowlist — +# the security posture documented in README.md/docs/DEPLOYMENT.md and this +# project's own blog post. This release intentionally opts out of that bound: +# it's the shared entry point used to reach arbitrary ClickHouse clusters via +# the "Advanced — connect to another server" field (e.g. investigating a +# customer cluster's connectivity), so the fixed 4-origin list blocked every +# such attempt with a bare "Failed to fetch" (no CSP-violation surfaced in the +# UI — see the linked issue). "https:" is a CSP scheme-source: any HTTPS +# origin is allowed, non-TLS schemes are still blocked. This trades away the +# origin-allowlist's defense-in-depth against exfiltration if the page is ever +# compromised (XSS/supply-chain) — deliberate for this instance, not a change +# to the chart's secure-by-default posture for other installs. +connectSrc: "https:" + service: type: ClusterIP port: 8080