Side-load executable javascript from allowlisted html

[mthang]

Our team members are working on 16S workflow using qiime2. This tool is used to visualize and create plot using the qiime2 file format. This tool generates a html file, but it's unable to display the output correctly.

Galaxy Version and/or server at which you observed the bug
Galaxy release 25.0
QIIME vizualisation extractor (Galaxy Version 0.1.0+galaxy0)
This issue happens on both Galaxy Europe and Galaxy Australia

Browser and Operating System
Operating System: Windows
Browser: Chrome

To Reproduce
Steps to reproduce the behavior:

1. here's the history link - https://usegalaxy.org.au/u/mike/h/test-workflow-qiime2-alpha-rarefaction

Expected behavior
I expected the output html page will be rendered and displayed rare fraction plot.

Screenshots
Galaxy Europe

Galaxy Australia

[mvdbeek]

@kysrpex @cat-bro can you place the output of "QIIME vizualisation extractor" on the allow list ? I would assume that's what's missing here.

[mthang]

@mvdbeek Thank you for speedy response ! I forgot to mention that in my description above. Yes. the GA screenshot was taken after the tool is whitelisted.

[mvdbeek]

I'm not sure if loading additional scripts is supposed to work. The recommended way to handle this would be through https://charts.galaxyproject.org/galaxy-charts/

[bgruening]

@bebatut do you know if this ever worked

[bernt-matthias]

Note, we only have the extractor tool because the viz is broken since 23 #17658 #18799

[bernt-matthias]

Or was it fixed: #18890 ?

[dannon]

@bernt-matthias Yeah, I thought the older issue had been resolved and we'd decided to continue with the external display application instead of hosting our own q2view plugin. (though, if an update on that side is what has broken this (again?) we may want to just do that anyway)

[mthang]

could it be the codebase (line 141 in base.py) that is not supporting jsonp ? I think it is Content-Type: application/javascript since QIIME vizualisation extractor has the following error message,

Refused to execute script from 'https://usegalaxy.org.au/datasets/a6e389a98c2d167816c6264c9d154dec/display/shannon.jsonp?callback=load_data' because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.

[neoformit]

@bernt-matthias @dannon I'm a little confused about this - Mike's screenshot above is not a Galaxy visualisation it's an HTML dataset produced by QIIME2 right?

@mvdbeek is it a security issue to execute jsonp fetched from the Galaxy server? In a whitelisted tool, is it any less secure than executing Js which we do already? My impression is that if Galaxy just set the correct Content-type header then this issue would be fixed.