Return 400 on invalid CSP reports

Not really a server error since there's nothing we can do about invalid
user-provided data.

Bug: T166229
Change-Id: I87a7be32ae7e80c112be556bc13db19f11e614ca

diff --git a/includes/api/ApiCSPReport.php b/includes/api/ApiCSPReport.php
index 4139019..3a78c13 100644 (file)
--- a/includes/api/ApiCSPReport.php
+++ b/includes/api/ApiCSPReport.php
@@ -186,9 +186,9 @@ class ApiCSPReport extends ApiBase {
                        'method' => $method,
                        'user-agent' => $this->getRequest()->getHeader( 'user-agent' )
                ] );
-               // 500 so it shows up in browser's developer console.
+               // Return 400 on error for user agents to display, e.g. to the console.
                $this->dieWithError(
-                       [ 'apierror-csp-report', wfEscapeWikiText( $code ) ], 'cspreport-' . $code, [], 500
+                       [ 'apierror-csp-report', wfEscapeWikiText( $code ) ], 'cspreport-' . $code, [], 400
                );
        }