Using TestRail UI Script to send GET/POST requests

Question

I am trying to integrate TestRail and Jenkins together and I want to use a TestRail UI script that creates a new button. This new button, when clicked, would send a POST request to Jenkins.

I cannot seem to send any GET/POST requests from this UI script. I have tried ajax, xhr, and fetch but they all give me the error

Refused to connect to {my_jenkins_url} because it violates the following Content Security Policy directive: "connect-src 'self' https://app.pendo.io https://data.pendo.io https://pendo-static-{...}-.storage.googleapis.com".

I'm not familiar with how ajax nor CSP work and I've looked at several other posts about it and nothing has fixed this for me. Is there something I need to set in TestRail? Or Jenkins?

In Jenkins I have these CORS Filter options enabled:

Access-Control-Allow-Origins: {my_testrail_url},{my_jenkins_url}
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Access-Control-Allow-Headers: Authorization
Access-Control-Expose-Headers:
Access-Control-Max-Age:

For now, I am just trying to get it to work by sending a GET to Jenkins to get a crumb. Here is how I am sending the request:

// Bind the click event to trigger the automated tests
    $(myButton).click(
      function() {
        const authToken = btoa(`${JENKINS_USERNAME}:${JENKINS_USER_API_KEY}`);
        var crumbURL = `https://${JENKINS_USERNAME}:${JENKINS_USER_API_KEY}@${JENKINS_URL}crumbIssuer/api/json`
        $.ajax(
          {
            url: crumbURL,
            dateType: "json",
            type: "GET",
            headers: {
              "Authorization" : "Basic " + authToken,
              //"Content-Security-Policy" : `connect-src 'self' ${crumbURL};`
            },
            success: function(data, textStatus, resp) {
              App.Dialogs.message(
                'GET request sent!',
                'Confirmation'
              );
              console.log(data);
            },
            error: function(requestObject, error, errorThrown) {
              console.error(`ERROR sending GET ${crumbURL}`);
              App.Dialogs.message(
                "There was an error retrieving the crumb. Please find more info on the console logs.",
                "Error"
              );
            }
          }
    )
    return false;
      } // end function()
    ); // end .click()
...
...

I found this UI script on github but it looked like it created an additional login form which I was hoping to avoid so I didn't copy it exactly. Any suggestions? TIA!

Answer 1

We were getting the same error with our UI script that launched pipelines in Gitlab, and had to go into Administration > Site Settings > Security in TestRail and enable the "CSP - Allow access TestRail to remote addresses" option and list our gitlab url in the field: Screenshot from TestRail Admin Area