OBI 12c: HTML Narrative View Cannot Access External URL

Adam Powell-Oracle

We have some d3 analyses, built as html narrative views, which were working in 11g but do not render at all in 12c. The issue seems to be firewall/proxy related, in that it can't connect out to the d3 script (http://d3js.org/d3.v3.min.js). I've tried just a basic html block with an img tag pointing to an external URL and that's not working either, it will only work if the src is to a local path on the BI server.

Is there some kind of proxy setting within OBI 12c? It seems odd that this would work OOTB with 11g but not at all with 12c.

Gianni Ceresa

Same browser, network etc. used to compare your working 11g and not working 12c ?

Because honestly it sounds strange.

First, being you I would definitely download the d3.v3.min.js library and copy it into an analyticsRes folder deployed on your OBIEE (what if D3  site just goes down? Your things stop working for a little missing file you are must have locally).

Even if OBIEE 12c would have a proxy (not the case AFAIK) it will have no impact as that kind of code is parsed and executed by your browser, the OBIEE server isn't aware it exists (well, it knows it but has nothing to do with it).

I just try on a SampleApp 12c to include a picture using an external URL into a narrative and it works just fine ...

What does the developer tools included in your browser tell you? Do you  see the HTTP call to get the JS library from the external site? Is that piece of code still included in the page? I guess the developer tools extension is probably your best way to find out what happen ...

Adam Powell-Oracle

Thanks for the response. Yes, it was from the same machine/browser, definitely strange behavior.

We were able to get things working after copying the d3 library up to the BI server. That's the method we planned to have an end user follow anyway, we were just testing with the URL while developing the analyses.

Just FYI, here is the console output when attempting to use the d3 URL:

Refused to load the script 'https://d3js.org/d3.v3.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval'"

Gianni Ceresa

Interesting, but it's definitely something at the browser level (the way I understand it).

And as you did, deploying a copy of the JS file "locally" on the server, is always the way to go just to be sure of what the library does (guess what happen if the D3 site is hacked and their library takes your data from the page and send it to an external site etc., it's where the message refusing to load .... is supposed to protect you).