Possible to ignore external resources

Created on 15 July 2025, 18 days ago

Problem/Motivation

We have installed the two additonal modules for CKEditor:

https://www.drupal.org/project/ckeditor5_plugin_pack
https://www.drupal.org/project/ckeditor5_word_count

We're logging the unknown external resources. These two modules are extremely flooding our (klaro) logs with their translations js scripts.

Unknown external resource https://cdn.ckeditor.com/ckeditor5/44.0.0/dll/template/translations/fr.js requested, we recommend to create a service for this resource.

There seems to be no possibility to have known resources just ignored, right? One always have to add these to the consent? But since these are only relevant for editors, we do not need this. It would be nice just to mark these as "known and ignore".

What is the proposed configuration for such cases?

💬 Support request
Status

Active

Version

3.0

Component

Miscellaneous

Created by

🇩🇪Germany droprocker

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @droprocker
  • 🇩🇪Germany jan kellermann

    Thank you for your proposal. This is a good idea to add a field for ignoring external resources pattern.

    A quick workaround should be to add `cdn.ckeditor.com` in `/admin/config/user-interface/klaro/services/cms` => `Advanced` => `Sources`.

  • 🇩🇪Germany droprocker

    Thanks for your feedback. The workaround works. Looking forward for the implementation of the ignore-feature. ;-)

  • 🇩🇪Germany jan kellermann

    We'll add that to our list.

    But could you please clarify with the module maintainers why external files are being loaded there in the first place? This generally leads to problems and should be avoided. See here :

    Using a CDN was historically thought to be beneficial. However, things have changed, and it is in general not a good idea to load libraries from a CDN; avoid this if possible.

  • 🇩🇪Germany droprocker

    The CKEditor5 Plugin Pack module ( https://www.drupal.org/project/ckeditor5_plugin_pack ) is having the option to load the libraries from within your own filesystem. From their docs:

    The main reason why we use CDN by default instead providing plugins directly with module files is that plugin libraries are delivered for each CKEditor 5 version separately and their code can become incompatible with the main CKEditor 5 bundle which is included in the Drupal core.

    When custom path is set you should keep the libraries version in sync with main bundle to avoid errors.

    The module CKEditor5 Word Count ( https://www.drupal.org/project/ckeditor5_word_count ) does not have this option at all. But may be the same reason.

    We are definitely going the way not using cdns at all.

  • 🇧🇪Belgium andreasderijcke Antwerpen / Gent

    Module maintainers do not always have say in whether a third party library they need (as in 'no better alternative') that is loading additional stuff from a CDN.

    For example, the Bynder module includes a widget from Bynder itself, and that uses CDN for additional stuff.
    There is no way the Bynder module maintainers can change this. They can ask Bynder not to use a CDN, but will they change it (and if so, how long will it take)

    Also, the inclusion is for backend only, so it feels wrong to have Bynder included in the banner for the end user, who will only see images (or files for that matter) from Bynder without addition scripts.

  • 🇧🇪Belgium andreasderijcke Antwerpen / Gent

    Perhaps the resource detection can be skipped (and thus no logging) for all paths that are configured in the 'Disable Klaro! element and dont block attributed resources on following url patterns' option?

    The option description states

    ... On these paths no resources are blocked and Klaro! will be disabled.

    Which might imply the unknown resource detection is also not active, but based on the logs it is active on those paths.

Production build 0.71.5 2024