ATLAS-5363: Atlas Documentation UI: REST API documentation styling broken on atlas.apache.org due to CSP violation - #721
Open
Brijesh619 wants to merge 3 commits into
Open
Conversation
Brijesh619
force-pushed
the
ATLAS-5363
branch
2 times, most recently
from
August 13, 2026 11:37
b890258 to
5ebcede
Compare
…oken on atlas.apache.org due to CSP violation
…oken on atlas.apache.org due to CSP violation
Brijesh619
force-pushed
the
ATLAS-5363
branch
from
September 3, 2026 19:29
5ebcede to
642c297
Compare
Contributor
Author
…oken on atlas.apache.org due to CSP violation
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.


What changes were proposed in this pull request?
This PR resolves ATLAS-5363 by fixing broken styling and Content Security Policy (CSP) violations on the Enunciate-generated REST API documentation hosted on
atlas.apache.org, while updating third-party license declarations per Apache Foundation standards.Previously, generated API docs relied on external CDNs (
bootstrapcdn.com,code.jquery.com,cdn.jsdelivr.net), which were blocked by strict CSP rules, causing unstyled pages and script execution failures.This patch introduces the following changes:
1. 3rd-Party License & NOTICE Updates
3party-licenses/:bootstrap-LICENSE(MIT License for Bootstrap 3.4.1)jquery-LICENSE(MIT License for jQuery 1.12.2)google-code-prettify-LICENSE(Apache 2.0 License for Google Code Prettify)Apache Atlas Subcomponents:in bothLICENSEanddocs/src/documents/Project-Info/ProjectLicense.md.NOTICEtoCopyright [2015-2026] The Apache Software Foundation.2. Offline CSP Asset Bundling
webapp/src/main/enunciate-assets/:bootstrap.min.css,bootstrap.min.js,jquery-1.12.2.min.js,run_prettify.js, andprettify.css.run_prettify.jsscript loader to derive its base script location dynamically at runtime (W = O.src.replace(...)) and loadprettify.css, skins, and lang extensions locally instead of fetching fromcdn.jsdelivr.net.webapp/pom.xmlandjquery-1.12.2.min.js.3. Maven Antrun Execution (
fix-enunciate-csp-assets)fix-enunciate-csp-assetsand guarded execution with<skip>${skipEnunciate}</skip>.<fileset>tasks withfailonerror="true".<replace>tasks to swap external CDN URLs for relative local asset paths across all generated HTML/JS files intarget/api/v2/.<fail>build-step assertions to verify zero CDN references (bootstrapcdn.com,code.jquery.com,cdn.jsdelivr.net) remain in generated API documentation.4. Docs & Tooling Enhancements
docs/crypto-fallback.jsto safely attemptcrypto.createHash('md4')first before falling back tosha256(Node 17+ / OpenSSL 3.0 compatibility), and logged warnings forECONNRESET.docs/src/documents/RestAPI.md.How was this patch tested?
mvn clean package -pl webapp -DskipTests -DskipEnunciate=trueand verifiedapache-rat-pluginpasses with 0 unapproved licenses.mvn clean package -pl webapp -DskipTestsand verified:<fileset>asset copy tasks executed cleanly withfailonerror="true".<fail>assertions verified 0 CDN URLs remain intarget/api/v2/.target/api/v2/apidocs/index.htmland resource pages (data.html,resource_*.html,json_*.html) to confirm all CSS/JS references use local relative paths (css/bootstrap.min.css,js/jquery-1.12.2.min.js,js/run_prettify.js).npm run buildindocs/and verified successful site generation (Build successfully created).webapp/target/api/v2/apidocs/locally and verified in browser DevTools that layout, styling, and code syntax highlighting (run_prettify) load properly with zero CSP console errors.