[JENKINS-75769] HTML Publisher Plugin not rendering CSS/JS in HTML reports after recent Jenkins update

[jenkins-infra-bot]

After a recent update to Jenkins, HTML reports published using the HTML Publisher Plugin are not rendering properly. The `report.html` file opens, but associated CSS and JavaScript files are not applied, resulting in a plain-text or unstructured view.

Previously, the same configuration displayed well-formatted reports. The ExtentReports folder includes subfolders (css, js, media), and the plugin is correctly configured with:

• Directory: ExtentReports/
• Index: report.html

We suspect that CSP or Jenkins core behavior might have changed and is now blocking JS/CSS.

Steps to reproduce:
1. Configure HTML Publisher Plugin with ExtentReports folder
2. Trigger a test run that generates the report
3. Open published `report.html` from Jenkins sidebar

Expected:

• Fully styled report with all assets loaded

Actual:

• HTML loads without CSS or JS, making the report unreadable

This is impacting automation visibility and report sharing. Please advise or suggest a workaround if it's a security change.

Screenshots attached.

---

Originally reported by bhanu9515, imported from: HTML Publisher Plugin not rendering CSS/JS in HTML reports after recent Jenkins update

• assignee: r2b2_nz
• status: Open
• priority: Major
• component(s): htmlpublisher-plugin
• resolution: Unresolved
• votes: 0
• watchers: 2
• imported: 20251211-193728

Raw content of original issue

After a recent update to Jenkins, HTML reports published using the HTML Publisher Plugin are not rendering properly. The `report.html` file opens, but associated CSS and JavaScript files are not applied, resulting in a plain-text or unstructured view.

Previously, the same configuration displayed well-formatted reports. The ExtentReports folder includes subfolders (css, js, media), and the plugin is correctly configured with:

	
Directory: ExtentReports/
	
Index: report.html



We suspect that CSP or Jenkins core behavior might have changed and is now blocking JS/CSS.

Steps to reproduce:
1. Configure HTML Publisher Plugin with ExtentReports folder
2. Trigger a test run that generates the report
3. Open published `report.html` from Jenkins sidebar

Expected:

	
Fully styled report with all assets loaded



Actual:

	
HTML loads without CSS or JS, making the report unreadable



This is impacting automation visibility and report sharing. Please advise or suggest a workaround if it's a security change.

Screenshots attached.

1 attachment

• Screenshot (42).png

  

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  Please provide more details so that others understand how to duplicate the issue.  "How to report an issue" provides a checklist of the type of information that is needed.
  
  In this specific case, it is important that you provide the specific versions before the change was detected and the specific versions after the change was detected.  That helps others to identify the cause of the change.
  
  Please provide a Zip file that contains the contents of the ExtentReports folder so that others can unpack that Zip file and confirm that the rendering is unexpected.
  
  Please also note the configuration of your resource root URL,  That may provide additional information,
  

Please provide more details so that others understand how to duplicate the issue. "How to report an issue" provides a checklist of the type of information that is needed.

In this specific case, it is important that you provide the specific versions before the change was detected and the specific versions after the change was detected. That helps others to identify the cause of the change.

Please provide a Zip file that contains the contents of the ExtentReports folder so that others can unpack that Zip file and confirm that the rendering is unexpected.

Please also note the configuration of your resource root URL, That may provide additional information,

[dchiaramello]

Hello. I'm confronted to the same problem of an HTML report incorrectly displayed, generated by the following Jenkinsfile code:

publishHTML([
    reportName: 'Karate Reports',
    reportDir: 'acceptance/target/karate-reports',
    reportFiles: 'karate-summary.html',
    keepAll: true,
    alwaysLinkToLastBuild: true
])

Here is the displayed report:

Here is the ZIP file retrieved by the TopRight "Zip" button in the report:
Karate_20Reports.zip

When decompressed, the karate-summary.html file found in that ZIP file is correctly displayed by the browser:

It also used to be correctly displayed by a previous Jenkins version, but I'm not able to tell you which version it was before that one... And I don't have access to Jenkins logs, I'm just a user and not an admin...

Current Jenkins version: Version 2.504.3 (jenkins-2.504.3-1.1.noarch)
Current HTML Publisher Plugin version: 4.27.1
Jenkins is running as an application on Red Hat Enterprise Linux release 9.6 (redhat-release-9.6-0.1.el9.x86_64)
Java version:

openjdk 21.0.11 2026-04-21 LTS
OpenJDK Runtime Environment (Red_Hat-21.0.11.0.10-1) (build 21.0.11+10-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-21.0.11.0.10-1) (build 21.0.11+10-LTS, mixed mode, sharing)

Browsers: Edge and Chrome

[dchiaramello]

The problem I had to render my page could be explained by the following log:

Loading the script 'https://app.posthog.com/static/array.js' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked.

The page tries to access to some Javascript content located on https://app.posthog.com - but the Content Security Policy directive found in the HTML page asking for that Javascript does not allow to reach that site, leading to that Javascript code to be blocked...

The "real" solution is to contact the team in charge of generating that HTML report, and to ask them to generate HTML pages which configure their Content Security Policy accordingly. However, on Chrome, I "workarounded" it by installing the "Disable Content-Security-Policy" Extension, and by enabling it each time I want to look at such report...

So, the problem does NOT come from the HTML Publisher Plugin or from Jenkins itself, but from the generated HTML report....