There is a CSP (Content-Security-Policy-Report-Only) defined in our web app which is working in an iframe. This CSP allows https://www.google-analytics.com/analytics.jsin a script-src directive. In spite of this, we are receiving a huge amount of CSP reports about blocking the https://www.google-analytics.com/analytics.js. This only happens in Firefox (74-78) on various operating systems: Windows 10, Linux(Ubunu) and macOS (we see this in sentry.io, where all of our CSP reports collected). Here is an example of such a report.
{
"csp-report": {
"blocked_uri": "https://www.google-analytics.com/analytics.js",
"referrer": "",
"violated_directive": "script-src",
"document_uri": "https://ourappdomain.herokuapp.com",
"original_policy": "style-src 'report-sample' 'unsafe-inline' https://ourappdomain.herokuapp.com https://d301sr5gafysq2.cloudfront.net https://aui-cdn.atlassian.com/aui-adg/6.0.0/css/aui.min.css https://aui-cdn.atlassian.com/aui-adg/6.0.0/css/aui-experimental.min.css; script-src 'report-sample' 'unsafe-eval' https://ourappdomain.herokuapp.com https://bitbucket.org/atlassian-connect/all.js https://www.google-analytics.com/analytics.js https://aui-cdn.atlassian.com/aui-adg/6.0.0/js/aui.min.js https://aui-cdn.atlassian.com/aui-adg/6.0.0/js/aui-soy.min.js https://aui-cdn.atlassian.com/aui-adg/6.0.0/js/aui-experimental.min.js https://aui-cdn.atlassian.com/aui-adg/6.0.0/js/aui-datepicker.min.js https://cdnjs.cloudflare.com/ajax/libs/require.js/2.3.6/require.min.js https://cdnjs.cloudflare.com/ajax/libs/underscore.js/1.8.3/underscore-min.js https://cdnjs.cloudflare.com/ajax/libs/backbone.js/1.3.3/backbone-min.js https://cdnjs.cloudflare.com/ajax/libs/lodash.js/3.8.0/lodash.min.js https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.min.js https://cdnjs.cloudflare.com/ajax/libs/d3/5.7.0/d3.min.js https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/crypto-js.min.js https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.9.0/moment.min.js https://cdnjs.cloudflare.com/ajax/libs/react/16.13.1/umd/react.production.min.js https://cdnjs.cloudflare.com/ajax/libs/react-dom/16.13.1/umd/react-dom.production.min.js; form-action 'none'; connect-src https://ourappdomain.herokuapp.com https://api.bitbucket.org https://sentry.io https://www.google-analytics.com https://d301sr5gafysq2.cloudfront.net; img-src https:; font-src https://aui-cdn.atlassian.com; object-src 'none'; default-src 'none'; base-uri 'none'",
"effective_directive": "script-src"
}
}
Why this can happen?