0029857: Errors trying to load moment.js library from CDN - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update

0029857	mantisbt	bugtracker	public	2022-04-14 04:03	2022-05-10 09:56

Reporter	dregad	Assigned To	dregad
Priority	high	Severity	major	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	2.25.3
Target Version	2.25.4	Fixed in Version	2.25.4

Summary	0029857: Errors trying to load moment.js library from CDN
Description	The browser's console reports the following errors `None of the “sha512” hashes in the integrity attribute match the content of the subresource. my_view_page.php None of the “sha512” hashes in the integrity attribute match the content of the subresource. my_view_page.php Uncaught bootstrap-datetimepicker requires Moment.js to be loaded first bootstrap-datetimepicker.min.js:1:317 Uncaught ReferenceError: moment is not defined <anonymous> http://localhost/mantis/js/common.js:323 jQuery 8 common.js:323:3`
Additional Information	This a regression that was introduced by 0029849, but the problem's root cause is not with MantisBT's setup - it is due to invalid resources on cdnjs. As a workaround, use the bundled libraries (i.e. set `$g_cdn_enabled = OFF;` in config_inc.php)
Tags	No tags attached.

dregad 2022-04-14 04:30 developer ~0066424	There seems to be something wrong with CDNJS. Someone else reported the same problem with moment.min.js, see https://github.com/cdnjs/cdnjs/discussions/14124 There seems to be a known issue affecting at least one other library https://github.com/cdnjs/cdnjs/issues/14080 https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.2/moment-with-locales.min.js currently yields a 404 error, so we can't calculate the SRI ourselves.

dregad 2022-04-14 05:09 developer ~0066427	Another workaround would be to switch to jsDelivr (https://cdn.jsdelivr.net/npm/moment@2.29.2/min/moment-with-locales.min.js) instead of cdnjs. Waiting for feedback from cdnjs, if they can fix the issue quickly it's probably not worth the effort to switch on our end considering that we already have a workaround to switch CDN off.

atrol 2022-04-14 05:35 developer ~0066429 Last edited: 2022-04-14 05:36	@dregad I changed "Additional Information" The default setting is `$g_cdn_enabled = OFF;`, so I guess that not that many users are affected when using 2.25.3.

dregad 2022-04-14 06:10 developer ~0066430	I changed "Additional Information" Oops, thanks for correcting (Ah, the joys of copy/paste...)

atrol 2022-04-26 14:25 developer ~0066494	@dregad moment.js 2.29.3 seems to be OK.

dregad 2022-04-27 06:28 developer ~0066500	moment.js 2.29.3 seems to be OK. I noticed yesterday afternoon that 2.29.3 had been released and the cdnjs resources seemed OK [1], but did not have the time to make an actual test. I have tested now and confirmed that the javascript and hash are working, so I'll upgrade the library. Shame that they have apparently fixed the problem, but did not apply the correction to 2.29.2.

atrol 2022-04-27 14:02 developer ~0066504	@dregad I updated mantisbt.org/bugs and reenabled CDN.

dregad 2022-04-28 06:38 developer ~0066508	Thanks !

MantisBT: master-2.25 0ef052b7 2022-04-27 06:31 dregad Details Diff	Update moment.js library to 2.29.3 There is a problem with the moment.js library's SRI hash for 2.29.2 on cdnjs.com [1], which is preventing it to load when $g_cdn_enabled = ON. The issue has not yet been solved, but moment.js 2.29.3 has been released and the new version's CDN resources are valid, so we'll upgrade to that instead of waiting for cdnjs to fix 2.29.2. Fixes 0029857 [1]: https://github.com/cdnjs/cdnjs/issues/14080		Affected Issues 0029857
	mod - core/constant_inc.php		Diff File
	mod - library/README.md		Diff File