andyward's avatar
andyward
Regular Visitor
3 years ago
Status:
Investigating

Custom visual development - access to external resources using domain-names with hyphens is broken.

When developing a custom visual that needs to access external resources you can white list domains to permit web access as per https://learn.microsoft.com/en-us/power-bi/developer/visuals/capabilitie...
APIS and Embedding
Custom Visuals
andyward's avatar
andyward
Regular Visitor
2 years ago

Any update on this? Can I make another request that this be considered a bug, not a feature request?

 

Domain names containing a 'dash' / hypen are fully legal according to RFC1035 (DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION): see page 7: 

<let-dig-hyp> ::= <let-dig> | "-"

As the custom visual whitelisting code is currently implemented it seems the WebAccess sanitisation precent generation of the CSP completely for custom visuals that need to whitelist access to any resource that contains a hyphen. So just adding one domain with a hypen into the custom visual's Web access parameters list breaks all whitelisted web access for all domains.

 

Domains containing hypens are not unusual. Just looking at a random list of top 100 websites shows a few high profile sites with domains that could not whitelist a visual with their own domain due this issue:

 

  • coca-cola.com
  • t-mobile.com
  • merriam-webster.com
  • harley-davidson.com

And as mentioned earlier, a lot of folks with azurewebsites.net sites use '-' in their instance name.

 

Surely this bug should be fixed?

Completed Ideas