Information Security 4 min read

Resolving CSS/JS Loading Issues in Jenkins HTML Publisher Plugin by Adjusting CSP

This article explains why Jenkins' HTML Publisher Plugin often fails to load custom CSS and JavaScript due to its default Content Security Policy, and provides two solutions: temporarily disabling CSP via a Groovy command and permanently applying the change using a startup-triggered job.

360 Quality & Efficiency
360 Quality & Efficiency
360 Quality & Efficiency
Resolving CSS/JS Loading Issues in Jenkins HTML Publisher Plugin by Adjusting CSP

When deploying Jenkins continuous integration pipelines, the HTML Publisher Plugin is commonly used to display test reports. To improve readability, custom CSS and JavaScript are often added for styling and animation. However, the rendered reports frequently appear broken: styles are missing, animations do not run, and the browser console shows CSS/JS loading failures.

Reason analysis

Jenkins protects itself from malicious HTML/JS by applying a default Content Security Policy (CSP):

sandbox; default-src 'none'; img-src 'self'; style-src 'self';

Under this policy, only CSS and image files hosted on the Jenkins server are allowed. The following content types are blocked:

JavaScript

plugins (object/embed)

inline style sheets and external CSS files

inline images and external image files

frames

web fonts

XHR/AJAX requests

Solution – Method 1

Temporarily disable the CSP by setting the system property via a Groovy script. Execute the following command in Manage Jenkins → Script Console and run it:

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "")

After running the script, rebuild the original job; the HTML page will display correctly. Note that the CSP resets to its default after a Jenkins restart, so this method is only temporary.

Solution – Method 2 (Permanent)

Use two Jenkins plugins— Startup Trigger and Groovy —to apply the CSP change automatically on startup:

Create a new Jenkins job dedicated to running at startup.

In the "Build Triggers" section, enable "Build when job nodes start".

In the "Build" section, add an "Execute system Groovy script" step with the same command:

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "")

Run this job once, then rebuild the original project. The custom CSS/JS will now load correctly each time Jenkins starts.

By adjusting the CSP either temporarily or permanently, the HTML Publisher Plugin can render test reports with the intended styling and interactive features.

ci/cdsecurityCSPGroovyJenkinsHTML Publisher
360 Quality & Efficiency
Written by

360 Quality & Efficiency

360 Quality & Efficiency focuses on seamlessly integrating quality and efficiency in R&D, sharing 360’s internal best practices with industry peers to foster collaboration among Chinese enterprises and drive greater efficiency value.

0 followers
Reader feedback

How this landed with the community

login Sign in to like

Rate this article

Was this worth your time?

Sign in to rate
Discussion

0 Comments

Thoughtful readers leave field notes, pushback, and hard-won operational detail here.