Mermaid diagrams fail to render in Safari on self-managed instances — sandboxed iframe CSP script-src 'self' blocked under opaque origin
### Summary
On self-managed **GitLab CE 19.0.1 (Omnibus)**, Mermaid diagrams do not render in **Safari**. The diagram source is valid (renders correctly in Firefox), but the sandboxed Mermaid iframe at `/-/sandbox/mermaid_v11` cannot load its webpack chunk and Safari reports a CSP `script-src` violation.
Root cause: the Mermaid sandbox iframe is sandboxed **without** `allow-same-origin`, so per spec its origin is opaque/`null`. The CSP applied to that page (set in `SandboxController`) uses `script-src 'self' 'unsafe-eval'`. Safari/WebKit evaluates `'self'` against the iframe's opaque origin, which never matches the instance host, so the **same-origin** chunk `…/assets/webpack/sandboxed_mermaid_v11.*.chunk.js` is refused. Firefox and Chrome resolve `'self'` against the response URL's origin and load the chunk fine, so the bug is browser-dependent and only manifests in Safari.
This is GitLab emitting the policy, not a reverse proxy (verified below), and it is **not** configurable via `gitlab.rb` because `SandboxController#apply_mermaid_csp` calls `policy.directives.clear` and rebuilds the policy from a hardcoded directive set.
### Steps to reproduce
1. On a self-managed GitLab CE 19.0.1 instance with **no** custom CSP configured (`gitlab_rails['content_security_policy']` left at the default / disabled).
2. Add a Markdown file to any project containing a Mermaid block, e.g.:
<pre>
```mermaid
flowchart TD
A[Start] --> B[End]
```
</pre>
3. Open the rendered Markdown (file preview / blob view) in **Safari**.
4. The diagram does not render. Open Web Inspector → Console.
5. Observe the CSP `script-src` refusal and the chunk-load failure (see logs below).
6. Open the same file in **Firefox** → the diagram renders correctly.
### Example Project
This reproduces on self-managed instances specifically (the iframe origin is opaque and the sandbox `script-src` relies on `'self'`). A minimal Markdown file with the Mermaid block above is sufficient — it is not document-specific; every diagram shows the same failure in Safari.
Related SaaS-side report with the same symptom class (CSP blocking the sandbox webpack chunk): #600453. Related self-managed report on the same opaque-origin mechanism (via `Cross-Origin-Resource-Policy`): #597837.
### What is the current *bug* behavior?
In Safari, the Mermaid diagram fails to render. The browser console shows the sandbox webpack chunk being refused by CSP and a subsequent chunk-load error, e.g.:
```
Refused to load https://gitlab.example.com/assets/webpack/sandboxed_mermaid_v11.15d76021.chunk.js
because it does not appear in the script-src directive of the Content Security Policy.
```
(`gitlab.example.com` stands in for the instance host; the chunk hash will differ per build.)
### What is the expected *correct* behavior?
The Mermaid diagram renders its SVG in Safari, as it already does in Firefox and Chrome. The sandbox `script-src` should authorize the same-origin `…/assets/webpack/*.chunk.js` even when the iframe is in an opaque origin.
### Relevant logs and/or screenshots
**Browser:** Safari Version 26.5 (21624.2.5.11.4) — fails. Firefox 151.0.2 (aarch64) — renders correctly.
**CSP header on the sandbox page** (`GET /-/sandbox/mermaid_v11`):
```
Content-Security-Policy: img-src 'self' data: blob: http: https:; media-src 'self' data: blob: http: https:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'self'; default-src 'self'; font-src 'self'; worker-src 'none'; connect-src 'none'; frame-src 'none'; object-src 'none'
```
**The policy is emitted by GitLab, not by the reverse proxy.** Requesting the sandbox page through the external load balancer and directly against the GitLab node return byte-identical headers:
```
# Through the load balancer
$ curl -sI -k https://gitlab.example.com/-/sandbox/mermaid_v11 | grep -i content-security-policy
content-security-policy: … script-src 'self' 'unsafe-eval'; …
# Direct to the GitLab node (bypassing the LB via --resolve)
$ curl -sI -k --resolve gitlab.example.com:443:<gitlab-node-ip> https://gitlab.example.com/-/sandbox/mermaid_v11 | grep -i content-security-policy
content-security-policy: … script-src 'self' 'unsafe-eval'; …
```
**Why `'self'` fails here:** the sandbox iframe is rendered with `sandbox="allow-scripts"` and no `allow-same-origin`. Per the [MDN sandbox docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/sandbox), a sandboxed resource without `allow-same-origin` has a `null` (opaque) origin. WebKit matches the `'self'` source expression against that opaque origin, which does not match the instance host, so the same-host chunk is blocked. Chromium/Gecko match `'self'` against the response URL origin, so they are unaffected.
### Output of checks
<!-- This is a self-managed instance (GitLab CE 19.0.1 Omnibus), not GitLab.com. -->
Reverse proxy: external nginx in front of GitLab; the bundled Omnibus nginx is disabled. The CSP header is unmodified by the proxy (shown identical direct-to-node above).
#### Results of GitLab environment info
<details>
<summary>Expand for output related to GitLab environment info</summary>
<pre>
System information
System:
Current User: git
Using RVM: no
Ruby Version: 3.3.11
Gem Version: 3.7.1
Bundler Version:4.0.10
Rake Version: 13.4.2
Redis Version: 7.2.11
Sidekiq Version:7.3.9
Go Version: unknown
GitLab information
Version: 19.0.1
Revision: 35d349e97ce
Directory: /opt/gitlab/embedded/service/gitlab-rails
DB Adapter: PostgreSQL
DB Version: 17.8
URL: https://gitlab.example.com
HTTP Clone URL: https://gitlab.example.com/some-group/some-project.git
SSH Clone URL: git@gitlab.example.com:some-group/some-project.git
Using LDAP: yes
Using Omniauth: yes
Omniauth Providers:
GitLab Shell
Version: 14.51.0
Repository storages:
- default: unix:/var/opt/gitlab/gitaly/gitaly.socket
GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell
Gitaly
- default Address: unix:/var/opt/gitlab/gitaly/gitaly.socket
- default Version: 19.0.1
- default Git Version: 2.53.ge417bf2
</pre>
</details>
#### Results of GitLab application Check
<details>
<summary>Expand for output related to the GitLab application check</summary>
<pre>
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 14.51.0 ? ... OK (14.51.0)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes
Number of Sidekiq processes (cluster/worker) ... 1/1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)
User output sanitized. Found 100 users of 100 limit.
Checking LDAP ... Finished
Checking GitLab App ...
Database config exists? ... yes
Tables are truncated? ... skipped
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Cable config exists? ... yes
Resque config exists? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... yes
Systemd unit files or init script exist? ... skipped (omnibus-gitlab has neither init script nor systemd units)
Systemd unit files or init script up-to-date? ... skipped (omnibus-gitlab has neither init script nor systemd units)
Projects have namespace: ...
40/1 ... yes
40/3 ... yes
15/5 ... yes
96/11 ... yes
101/14 ... yes
24/20 ... yes
2935/23 ... yes
40/26 ... yes
40/28 ... yes
69/29 ... yes
40/30 ... yes
101/32 ... yes
40/35 ... yes
40/36 ... yes
40/37 ... yes
88/42 ... yes
88/43 ... yes
88/44 ... yes
88/45 ... yes
96/50 ... yes
96/51 ... yes
97/52 ... yes
97/53 ... yes
101/54 ... yes
101/57 ... yes
22/58 ... yes
22/59 ... yes
40/60 ... yes
96/61 ... yes
41/62 ... yes
40/63 ... yes
40/64 ... yes
15/65 ... yes
22/66 ... yes
157/71 ... yes
40/73 ... yes
157/74 ... yes
159/75 ... yes
23/76 ... yes
40/77 ... yes
40/78 ... yes
170/79 ... yes
157/86 ... yes
40/87 ... yes
159/88 ... yes
22/89 ... yes
22/90 ... yes
22/91 ... yes
86/92 ... yes
86/93 ... yes
163/94 ... yes
179/95 ... yes
179/96 ... yes
179/97 ... yes
22/99 ... yes
22/100 ... yes
159/102 ... yes
677/103 ... yes
159/104 ... yes
179/105 ... yes
40/106 ... yes
159/107 ... yes
40/108 ... yes
159/109 ... yes
40/110 ... yes
206/111 ... yes
40/112 ... yes
40/113 ... yes
40/114 ... yes
40/115 ... yes
40/116 ... yes
40/117 ... yes
40/118 ... yes
40/119 ... yes
40/121 ... yes
40/122 ... yes
170/123 ... yes
27/125 ... yes
159/126 ... yes
22/127 ... yes
22/128 ... yes
22/130 ... yes
22/131 ... yes
22/132 ... yes
40/134 ... yes
341/137 ... yes
22/138 ... yes
22/139 ... yes
22/140 ... yes
22/141 ... yes
159/142 ... yes
40/143 ... yes
22/144 ... yes
22/145 ... yes
22/146 ... yes
22/147 ... yes
22/148 ... yes
40/149 ... yes
13/150 ... yes
22/151 ... yes
40/185 ... yes
69/186 ... yes
244/188 ... yes
22/189 ... yes
69/190 ... yes
22/193 ... yes
22/194 ... yes
261/195 ... yes
22/196 ... yes
22/197 ... yes
163/199 ... yes
22/200 ... yes
22/201 ... yes
22/202 ... yes
179/205 ... yes
179/206 ... yes
279/207 ... yes
268/208 ... yes
269/209 ... yes
269/210 ... yes
269/211 ... yes
69/213 ... yes
159/214 ... yes
282/217 ... yes
163/218 ... yes
69/220 ... yes
292/221 ... yes
22/223 ... yes
269/224 ... yes
269/225 ... yes
269/226 ... yes
304/229 ... yes
304/230 ... yes
304/231 ... yes
304/232 ... yes
304/233 ... yes
304/234 ... yes
304/235 ... yes
304/236 ... yes
304/237 ... yes
269/239 ... yes
269/240 ... yes
269/244 ... yes
269/245 ... yes
282/246 ... yes
320/247 ... yes
320/248 ... yes
319/249 ... yes
319/250 ... yes
319/251 ... yes
319/252 ... yes
319/253 ... yes
319/254 ... yes
319/255 ... yes
322/260 ... yes
322/261 ... yes
322/262 ... yes
322/263 ... yes
322/264 ... yes
322/265 ... yes
322/266 ... yes
269/267 ... yes
289/269 ... yes
269/270 ... yes
292/272 ... yes
292/273 ... yes
170/274 ... yes
22/276 ... yes
22/277 ... yes
329/278 ... yes
269/279 ... yes
269/283 ... yes
22/284 ... yes
15/285 ... yes
269/291 ... yes
69/292 ... yes
40/294 ... yes
261/296 ... yes
269/299 ... yes
269/300 ... yes
269/301 ... yes
261/302 ... yes
269/305 ... yes
279/306 ... yes
69/308 ... yes
269/309 ... yes
269/310 ... yes
677/311 ... yes
366/312 ... yes
355/314 ... yes
269/315 ... yes
343/316 ... yes
269/317 ... yes
373/318 ... yes
380/321 ... yes
40/323 ... yes
355/325 ... yes
341/327 ... yes
395/328 ... yes
22/329 ... yes
355/331 ... yes
22/335 ... yes
269/336 ... yes
395/337 ... yes
22/338 ... yes
395/339 ... yes
22/340 ... yes
163/341 ... yes
254/344 ... yes
82/346 ... yes
53/347 ... yes
85/349 ... yes
85/350 ... yes
254/352 ... yes
413/353 ... yes
413/354 ... yes
269/355 ... yes
416/356 ... yes
269/357 ... yes
413/359 ... yes
254/364 ... yes
269/368 ... yes
272/369 ... yes
269/370 ... yes
243/372 ... yes
22/373 ... yes
413/374 ... yes
22/376 ... yes
381/377 ... yes
22/378 ... yes
381/380 ... yes
381/381 ... yes
381/382 ... yes
395/385 ... yes
269/386 ... yes
381/387 ... yes
369/388 ... yes
243/389 ... yes
395/390 ... yes
243/391 ... yes
261/393 ... yes
441/395 ... yes
269/396 ... yes
269/397 ... yes
381/398 ... yes
269/399 ... yes
85/400 ... yes
381/401 ... yes
269/402 ... yes
381/404 ... yes
381/405 ... yes
101/409 ... yes
163/411 ... yes
381/416 ... yes
381/417 ... yes
458/418 ... yes
458/419 ... yes
269/420 ... yes
460/421 ... yes
454/422 ... yes
40/423 ... yes
254/424 ... yes
69/427 ... yes
40/429 ... yes
269/431 ... yes
165/432 ... yes
395/433 ... yes
381/434 ... yes
458/435 ... yes
22/436 ... yes
3122/440 ... yes
473/441 ... yes
764/442 ... yes
485/443 ... yes
40/446 ... yes
22/447 ... yes
40/448 ... yes
269/449 ... yes
269/450 ... yes
500/454 ... yes
22/455 ... yes
40/456 ... yes
355/458 ... yes
510/461 ... yes
40/467 ... yes
40/470 ... yes
510/472 ... yes
22/473 ... yes
348/474 ... yes
510/475 ... yes
510/476 ... yes
510/477 ... yes
22/479 ... yes
458/480 ... yes
40/481 ... yes
395/482 ... yes
510/483 ... yes
508/484 ... yes
508/485 ... yes
510/486 ... yes
510/489 ... yes
510/490 ... yes
22/491 ... yes
556/493 ... yes
510/500 ... yes
510/501 ... yes
510/502 ... yes
510/504 ... yes
490/511 ... yes
490/512 ... yes
438/513 ... yes
490/517 ... yes
510/518 ... yes
574/521 ... yes
574/522 ... yes
571/525 ... yes
22/527 ... yes
101/528 ... yes
490/529 ... yes
3122/537 ... yes
488/538 ... yes
488/539 ... yes
40/542 ... yes
510/543 ... yes
510/544 ... yes
40/546 ... yes
490/548 ... yes
566/551 ... yes
40/553 ... yes
510/554 ... yes
490/555 ... yes
490/556 ... yes
40/558 ... yes
269/559 ... yes
500/560 ... yes
500/561 ... yes
566/562 ... yes
510/563 ... yes
604/564 ... yes
566/565 ... yes
22/566 ... yes
604/567 ... yes
605/569 ... yes
605/570 ... yes
500/574 ... yes
22/576 ... yes
613/577 ... yes
613/578 ... yes
613/579 ... yes
613/580 ... yes
490/581 ... yes
528/582 ... yes
473/583 ... yes
613/584 ... yes
490/585 ... yes
613/586 ... yes
628/589 ... yes
628/590 ... yes
496/592 ... yes
496/593 ... yes
496/596 ... yes
496/597 ... yes
381/599 ... yes
496/600 ... yes
496/601 ... yes
496/602 ... yes
613/603 ... yes
243/604 ... yes
22/607 ... yes
490/609 ... yes
510/611 ... yes
619/612 ... yes
500/613 ... yes
490/615 ... yes
619/616 ... yes
604/617 ... yes
653/618 ... yes
432/619 ... yes
490/620 ... yes
742/621 ... yes
653/622 ... yes
653/624 ... yes
604/625 ... yes
612/627 ... yes
490/628 ... yes
612/629 ... yes
510/630 ... yes
269/631 ... yes
612/632 ... yes
490/634 ... yes
490/635 ... yes
661/636 ... yes
613/641 ... yes
613/643 ... yes
742/644 ... yes
269/645 ... yes
677/646 ... yes
491/649 ... yes
742/651 ... yes
718/653 ... yes
15/654 ... yes
381/655 ... yes
682/656 ... yes
612/657 ... yes
413/658 ... yes
381/659 ... yes
341/662 ... yes
677/663 ... yes
688/664 ... yes
688/665 ... yes
689/666 ... yes
319/669 ... yes
688/670 ... yes
485/671 ... yes
490/673 ... yes
661/674 ... yes
22/676 ... yes
490/678 ... yes
40/680 ... yes
22/684 ... yes
500/686 ... yes
621/688 ... yes
621/689 ... yes
701/692 ... yes
701/693 ... yes
702/694 ... yes
488/697 ... yes
742/698 ... yes
499/701 ... yes
742/702 ... yes
701/703 ... yes
490/704 ... yes
653/706 ... yes
22/707 ... yes
701/709 ... yes
702/710 ... yes
718/711 ... yes
718/712 ... yes
696/713 ... yes
702/715 ... yes
485/716 ... yes
269/718 ... yes
718/719 ... yes
637/721 ... yes
702/722 ... yes
718/723 ... yes
24/725 ... yes
701/727 ... yes
163/730 ... yes
269/731 ... yes
269/732 ... yes
731/733 ... yes
731/734 ... yes
612/735 ... yes
292/736 ... yes
701/738 ... yes
269/739 ... yes
742/740 ... yes
742/741 ... yes
742/742 ... yes
745/744 ... yes
745/745 ... yes
745/746 ... yes
701/747 ... yes
465/748 ... yes
752/749 ... yes
623/750 ... yes
40/754 ... yes
485/755 ... yes
731/756 ... yes
764/758 ... yes
764/759 ... yes
605/760 ... yes
701/761 ... yes
731/762 ... yes
500/763 ... yes
269/764 ... yes
702/765 ... yes
702/766 ... yes
510/768 ... yes
702/769 ... yes
269/770 ... yes
752/771 ... yes
677/772 ... yes
309/773 ... yes
798/774 ... yes
799/775 ... yes
40/776 ... yes
701/777 ... yes
808/778 ... yes
269/779 ... yes
269/780 ... yes
269/781 ... yes
269/782 ... yes
269/783 ... yes
793/784 ... yes
653/785 ... yes
612/786 ... yes
500/787 ... yes
701/788 ... yes
793/789 ... yes
496/790 ... yes
269/791 ... yes
269/792 ... yes
269/793 ... yes
701/794 ... yes
381/795 ... yes
638/796 ... yes
793/797 ... yes
702/798 ... yes
269/799 ... yes
612/803 ... yes
745/804 ... yes
742/805 ... yes
488/807 ... yes
101/813 ... yes
381/814 ... yes
488/815 ... yes
488/816 ... yes
884/822 ... yes
886/823 ... yes
884/824 ... yes
269/826 ... yes
40/832 ... yes
619/834 ... yes
40/835 ... yes
903/836 ... yes
742/837 ... yes
96/838 ... yes
884/839 ... yes
619/840 ... yes
702/841 ... yes
807/842 ... yes
922/843 ... yes
488/844 ... yes
341/845 ... yes
6485/846 ... yes
488/849 ... yes
664/850 ... yes
664/852 ... yes
696/854 ... yes
931/855 ... yes
673/856 ... yes
752/858 ... yes
15/861 ... yes
488/862 ... yes
742/863 ... yes
742/864 ... yes
696/865 ... yes
890/866 ... yes
935/867 ... yes
488/869 ... yes
742/870 ... yes
488/872 ... yes
664/873 ... yes
764/874 ... yes
319/875 ... yes
3059/879 ... yes
496/880 ... yes
664/883 ... yes
742/884 ... yes
206/886 ... yes
490/887 ... yes
381/888 ... yes
627/890 ... yes
627/891 ... yes
627/892 ... yes
627/893 ... yes
40/894 ... yes
3064/895 ... yes
973/896 ... yes
973/897 ... yes
664/898 ... yes
85/899 ... yes
22/900 ... yes
496/901 ... yes
510/902 ... yes
702/903 ... yes
627/904 ... yes
627/905 ... yes
627/906 ... yes
627/907 ... yes
627/908 ... yes
627/909 ... yes
627/910 ... yes
627/911 ... yes
627/912 ... yes
627/913 ... yes
627/914 ... yes
627/915 ... yes
627/916 ... yes
627/917 ... yes
627/921 ... yes
627/922 ... yes
627/923 ... yes
664/924 ... yes
664/926 ... yes
22/927 ... yes
319/928 ... yes
890/931 ... yes
381/932 ... yes
1010/933 ... yes
1010/934 ... yes
319/935 ... yes
664/936 ... yes
490/937 ... yes
1010/938 ... yes
490/939 ... yes
701/940 ... yes
496/941 ... yes
1027/943 ... yes
723/944 ... yes
624/945 ... yes
490/946 ... yes
1027/956 ... yes
1027/958 ... yes
269/959 ... yes
269/960 ... yes
1042/961 ... yes
664/962 ... yes
490/966 ... yes
22/967 ... yes
807/969 ... yes
496/970 ... yes
491/971 ... yes
381/972 ... yes
488/976 ... yes
3336/977 ... yes
884/978 ... yes
884/979 ... yes
742/980 ... yes
3336/983 ... yes
1054/988 ... yes
612/990 ... yes
292/991 ... yes
1054/992 ... yes
621/993 ... yes
701/994 ... yes
664/995 ... yes
621/998 ... yes
701/999 ... yes
702/1000 ... yes
612/1002 ... yes
612/1003 ... yes
1035/1007 ... yes
1091/1008 ... yes
1091/1009 ... yes
1001/1010 ... yes
1091/1012 ... yes
22/1014 ... yes
922/1015 ... yes
490/1016 ... yes
1088/1017 ... yes
807/1019 ... yes
488/1021 ... yes
462/1022 ... yes
462/1023 ... yes
764/1024 ... yes
764/1025 ... yes
462/1026 ... yes
1010/1028 ... yes
1010/1029 ... yes
701/1030 ... yes
985/1031 ... yes
496/1032 ... yes
742/1033 ... yes
496/1034 ... yes
496/1035 ... yes
1010/1036 ... yes
1010/1037 ... yes
1010/1038 ... yes
490/1040 ... yes
490/1041 ... yes
488/1043 ... yes
742/1044 ... yes
931/1045 ... yes
1051/1046 ... yes
269/1049 ... yes
931/1051 ... yes
701/1052 ... yes
1010/1053 ... yes
1184/1056 ... yes
1184/1057 ... yes
1184/1058 ... yes
1184/1059 ... yes
22/1061 ... yes
742/1062 ... yes
653/1063 ... yes
477/1064 ... yes
1121/1065 ... yes
52/1068 ... yes
1195/1073 ... yes
1195/1074 ... yes
1195/1075 ... yes
935/1079 ... yes
664/1080 ... yes
462/1081 ... yes
1010/1082 ... yes
1193/1086 ... yes
22/1087 ... yes
1228/1088 ... yes
807/1089 ... yes
742/1091 ... yes
1091/1092 ... yes
1228/1093 ... yes
935/1094 ... yes
1091/1095 ... yes
1091/1096 ... yes
490/1097 ... yes
807/1098 ... yes
702/1099 ... yes
1205/1100 ... yes
612/1102 ... yes
1228/1103 ... yes
742/1104 ... yes
496/1105 ... yes
688/1106 ... yes
1228/1107 ... yes
1228/1108 ... yes
22/1109 ... yes
612/1110 ... yes
931/1112 ... yes
742/1113 ... yes
1228/1114 ... yes
1001/1115 ... yes
1091/1116 ... yes
1228/1118 ... yes
702/1119 ... yes
931/1122 ... yes
1228/1123 ... yes
1091/1127 ... yes
1228/1128 ... yes
1228/1129 ... yes
1228/1135 ... yes
807/1142 ... yes
764/1143 ... yes
764/1144 ... yes
1283/1145 ... yes
1091/1146 ... yes
1289/1147 ... yes
1289/1148 ... yes
1289/1149 ... yes
1289/1150 ... yes
1221/1156 ... yes
1221/1157 ... yes
1091/1158 ... yes
346/1159 ... yes
1220/1160 ... yes
1220/1162 ... yes
1220/1163 ... yes
1220/1164 ... yes
1220/1165 ... yes
1220/1166 ... yes
860/1167 ... yes
1283/1168 ... yes
22/1169 ... yes
653/1170 ... yes
490/1171 ... yes
931/1174 ... yes
490/1175 ... yes
282/1176 ... yes
1091/1177 ... yes
1306/1178 ... yes
1306/1179 ... yes
1306/1180 ... yes
488/1181 ... yes
488/1182 ... yes
1010/1184 ... yes
1316/1185 ... yes
496/1187 ... yes
496/1188 ... yes
807/1189 ... yes
1091/1190 ... yes
22/1191 ... yes
462/1192 ... yes
1235/1193 ... yes
163/1196 ... yes
764/1197 ... yes
884/1198 ... yes
88/1200 ... yes
623/1201 ... yes
15/1202 ... yes
15/1203 ... yes
269/1205 ... yes
490/1206 ... yes
701/1209 ... yes
1353/1210 ... yes
269/1211 ... yes
29/1212 ... yes
40/1213 ... yes
40/1214 ... yes
1371/1215 ... yes
691/1216 ... yes
22/1217 ... yes
1042/1220 ... yes
490/1221 ... yes
752/1222 ... yes
931/1223 ... yes
752/1224 ... yes
627/1225 ... yes
15/1227 ... yes
15/1228 ... yes
15/1229 ... yes
15/1230 ... yes
15/1232 ... yes
15/1233 ... yes
15/1234 ... yes
1402/1235 ... yes
1402/1236 ... yes
128/1237 ... yes
701/1238 ... yes
1402/1239 ... yes
752/1241 ... yes
742/1242 ... yes
96/1243 ... yes
764/1244 ... yes
764/1245 ... yes
15/1246 ... yes
22/1247 ... yes
1092/1249 ... yes
1421/1250 ... yes
701/1251 ... yes
701/1252 ... yes
752/1253 ... yes
624/1254 ... yes
605/1255 ... yes
605/1256 ... yes
15/1257 ... yes
745/1258 ... yes
15/1260 ... yes
15/1262 ... yes
1435/1263 ... yes
1435/1264 ... yes
1462/1265 ... yes
1462/1266 ... yes
793/1267 ... yes
793/1268 ... yes
1435/1269 ... yes
1435/1270 ... yes
1573/1272 ... yes
1462/1273 ... yes
1481/1274 ... yes
1481/1275 ... yes
1462/1276 ... yes
15/1277 ... yes
304/1278 ... yes
745/1279 ... yes
490/1280 ... yes
40/1281 ... yes
3336/1282 ... yes
128/1283 ... yes
22/1284 ... yes
22/1285 ... yes
1510/1287 ... yes
1514/1288 ... yes
1514/1290 ... yes
1514/1291 ... yes
1514/1292 ... yes
1514/1293 ... yes
1514/1294 ... yes
1510/1295 ... yes
1514/1301 ... yes
745/1302 ... yes
1402/1303 ... yes
6424/1306 ... yes
1435/1307 ... yes
15/1309 ... yes
1462/1310 ... yes
807/1312 ... yes
807/1313 ... yes
1348/1314 ... yes
1353/1315 ... yes
1568/1316 ... yes
1568/1317 ... yes
1568/1318 ... yes
1568/1319 ... yes
1574/1320 ... yes
1092/1321 ... yes
1574/1322 ... yes
15/1323 ... yes
1348/1324 ... yes
1581/1325 ... yes
1193/1326 ... yes
346/1327 ... yes
15/1329 ... yes
15/1333 ... yes
22/1334 ... yes
1159/1335 ... yes
1619/1339 ... yes
269/1340 ... yes
1638/1347 ... yes
1348/1348 ... yes
1462/1351 ... yes
1348/1353 ... yes
3122/1354 ... yes
752/1355 ... yes
931/1357 ... yes
1481/1359 ... yes
752/1361 ... yes
2697/1363 ... yes
1435/1365 ... yes
1462/1366 ... yes
701/1367 ... yes
15/1369 ... yes
807/1370 ... yes
1220/1371 ... yes
1220/1372 ... yes
2734/1374 ... yes
2734/1375 ... yes
2734/1376 ... yes
701/1379 ... yes
2734/1380 ... yes
2734/1381 ... yes
2734/1382 ... yes
2734/1383 ... yes
2734/1384 ... yes
2734/1385 ... yes
2734/1386 ... yes
2734/1387 ... yes
2734/1388 ... yes
2734/1389 ... yes
2734/1390 ... yes
2734/1391 ... yes
2734/1392 ... yes
2734/1393 ... yes
2734/1394 ... yes
2734/1395 ... yes
2734/1397 ... yes
2734/1398 ... yes
2734/1399 ... yes
2734/1400 ... yes
2734/1401 ... yes
2734/1402 ... yes
2734/1403 ... yes
2734/1405 ... yes
2734/1406 ... yes
2734/1407 ... yes
2734/1408 ... yes
2734/1410 ... yes
2734/1411 ... yes
2734/1412 ... yes
2734/1414 ... yes
2734/1415 ... yes
2734/1419 ... yes
2734/1420 ... yes
2734/1421 ... yes
2734/1431 ... yes
2799/1434 ... yes
931/1435 ... yes
2799/1436 ... yes
29/1438 ... yes
1481/1439 ... yes
15/1441 ... yes
2697/1444 ... yes
3062/1445 ... yes
879/1446 ... yes
1623/1447 ... yes
1623/1448 ... yes
1623/1449 ... yes
1623/1450 ... yes
807/1451 ... yes
15/1452 ... yes
611/1453 ... yes
343/1454 ... yes
2842/1455 ... yes
24/1456 ... yes
2728/1457 ... yes
1294/1458 ... yes
1230/1459 ... yes
1408/1460 ... yes
695/1461 ... yes
611/1462 ... yes
1189/1463 ... yes
1638/1465 ... yes
2860/1466 ... yes
2860/1467 ... yes
2867/1468 ... yes
269/1469 ... yes
15/1471 ... yes
15/1472 ... yes
1193/1473 ... yes
752/1474 ... yes
163/1475 ... yes
343/1477 ... yes
2891/1478 ... yes
2891/1479 ... yes
2891/1480 ... yes
22/1481 ... yes
2973/1482 ... yes
3086/1483 ... yes
6424/1484 ... yes
1348/1485 ... yes
701/1486 ... yes
1160/1487 ... yes
500/1488 ... yes
879/1489 ... yes
612/1490 ... yes
612/1491 ... yes
612/1492 ... yes
664/1493 ... yes
2930/1494 ... yes
2939/1495 ... yes
702/1496 ... yes
1091/1497 ... yes
2945/1498 ... yes
2697/1499 ... yes
2951/1500 ... yes
2951/1501 ... yes
1091/1502 ... yes
381/1503 ... yes
2961/1504 ... yes
437/1505 ... yes
701/1506 ... yes
485/1507 ... yes
752/1508 ... yes
807/1509 ... yes
701/1510 ... yes
1054/1511 ... yes
269/1512 ... yes
2978/1513 ... yes
2935/1514 ... yes
490/1515 ... yes
2991/1516 ... yes
2991/1517 ... yes
500/1518 ... yes
1091/1519 ... yes
223/1520 ... yes
15/1522 ... yes
2967/1527 ... yes
962/1528 ... yes
3062/1529 ... yes
3063/1530 ... yes
931/1531 ... yes
752/1533 ... yes
499/1534 ... yes
701/1535 ... yes
22/1537 ... yes
3042/1538 ... yes
3042/1539 ... yes
2991/1542 ... yes
1091/1543 ... yes
3042/1544 ... yes
3042/1545 ... yes
3054/1546 ... yes
3054/1547 ... yes
3042/1548 ... yes
3042/1549 ... yes
664/1550 ... yes
3063/1551 ... yes
2991/1552 ... yes
3061/1553 ... yes
931/1554 ... yes
269/1557 ... yes
15/1558 ... yes
2991/1559 ... yes
3037/1560 ... yes
752/1569 ... yes
3095/1570 ... yes
2867/1571 ... yes
3104/1572 ... yes
1619/1573 ... yes
807/1574 ... yes
29/1575 ... yes
1619/1576 ... yes
15/1577 ... yes
15/1578 ... yes
3086/1579 ... yes
3086/1580 ... yes
3086/1581 ... yes
3086/1582 ... yes
3086/1583 ... yes
346/1584 ... yes
3122/1585 ... yes
807/1586 ... yes
3122/1587 ... yes
1619/1588 ... yes
1619/1589 ... yes
269/1590 ... yes
664/1591 ... yes
319/1592 ... yes
3122/1593 ... yes
1421/1594 ... yes
752/1595 ... yes
3104/1596 ... yes
3059/1597 ... yes
3153/1602 ... yes
3042/1603 ... yes
605/1604 ... yes
3086/1605 ... yes
3062/1606 ... yes
3086/1607 ... yes
29/1609 ... yes
701/1610 ... yes
3178/1611 ... yes
15/1612 ... yes
3063/1613 ... yes
3042/1614 ... yes
752/1616 ... yes
807/1617 ... yes
3197/1619 ... yes
3197/1620 ... yes
3197/1622 ... yes
15/1623 ... yes
2930/1624 ... yes
701/1625 ... yes
22/1626 ... yes
22/1627 ... yes
3086/1628 ... yes
3086/1629 ... yes
3086/1630 ... yes
3063/1631 ... yes
1619/1633 ... yes
3224/1634 ... yes
15/1635 ... yes
1619/1636 ... yes
3104/1637 ... yes
15/1639 ... yes
334/1640 ... yes
334/1641 ... yes
3351/1644 ... yes
15/1645 ... yes
2697/1646 ... yes
1619/1648 ... yes
1619/1649 ... yes
3042/1652 ... yes
931/1654 ... yes
931/1655 ... yes
931/1656 ... yes
3351/1657 ... yes
3351/1658 ... yes
664/1659 ... yes
3333/1660 ... yes
98/1661 ... yes
3059/1662 ... yes
3224/1664 ... yes
1623/1665 ... yes
1623/1666 ... yes
1623/1667 ... yes
1619/1668 ... yes
3061/1669 ... yes
1619/1670 ... yes
3323/1671 ... yes
3325/1672 ... yes
334/1673 ... yes
3323/1674 ... yes
319/1675 ... yes
3013/1676 ... yes
752/1677 ... yes
3343/1679 ... yes
3345/1680 ... yes
3345/1681 ... yes
3345/1682 ... yes
3345/1683 ... yes
3059/1684 ... yes
1380/1685 ... yes
2697/1689 ... yes
1640/1690 ... yes
973/1691 ... yes
973/1692 ... yes
269/1693 ... yes
752/1694 ... yes
3298/1696 ... yes
3298/1697 ... yes
807/1698 ... yes
752/1699 ... yes
3122/1701 ... yes
3054/1702 ... yes
3336/1703 ... yes
269/1704 ... yes
98/1705 ... yes
98/1706 ... yes
3059/1707 ... yes
807/1708 ... yes
6424/1709 ... yes
3059/1711 ... yes
269/1712 ... yes
752/1713 ... yes
3013/1714 ... yes
269/1715 ... yes
269/1716 ... yes
1640/1717 ... yes
1619/1718 ... yes
1619/1719 ... yes
2935/1720 ... yes
22/1721 ... yes
752/1722 ... yes
380/1723 ... yes
2990/1724 ... yes
3456/1725 ... yes
3456/1726 ... yes
3456/1727 ... yes
380/1728 ... yes
2939/1730 ... yes
3086/1731 ... yes
346/1732 ... yes
3063/1733 ... yes
68/1735 ... yes
490/1736 ... yes
962/1737 ... yes
3062/1738 ... yes
884/1739 ... yes
3506/1740 ... yes
3511/1741 ... yes
3513/1742 ... yes
973/1743 ... yes
3086/1744 ... yes
701/1745 ... yes
752/1747 ... yes
752/1748 ... yes
3509/1750 ... yes
3508/1751 ... yes
5832/1752 ... yes
5832/1753 ... yes
701/1754 ... yes
931/1756 ... yes
445/1758 ... yes
3086/1759 ... yes
4338/1760 ... yes
369/1761 ... yes
723/1762 ... yes
1220/1766 ... yes
1619/1767 ... yes
1481/1768 ... yes
269/1769 ... yes
701/1770 ... yes
3283/1772 ... yes
3086/1773 ... yes
3062/1774 ... yes
369/1775 ... yes
3086/1777 ... yes
282/1778 ... yes
3614/1780 ... yes
931/1781 ... yes
1619/1782 ... yes
15/1783 ... yes
269/1785 ... yes
3301/1786 ... yes
22/1787 ... yes
1027/1788 ... yes
3086/1793 ... yes
3631/1794 ... yes
3509/1795 ... yes
3508/1796 ... yes
3509/1797 ... yes
3508/1798 ... yes
807/1799 ... yes
3508/1800 ... yes
3509/1801 ... yes
15/1802 ... yes
282/1804 ... yes
15/1805 ... yes
1080/1806 ... yes
3064/1807 ... yes
3013/1809 ... yes
3013/1810 ... yes
3013/1811 ... yes
3013/1812 ... yes
3013/1813 ... yes
3683/1814 ... yes
1289/1815 ... yes
1220/1816 ... yes
3693/1817 ... yes
3655/1818 ... yes
3655/1819 ... yes
3506/1820 ... yes
3655/1821 ... yes
1619/1822 ... yes
807/1823 ... yes
807/1825 ... yes
807/1826 ... yes
807/1827 ... yes
807/1828 ... yes
3059/1829 ... yes
15/1830 ... yes
500/1831 ... yes
701/1832 ... yes
701/1833 ... yes
3681/1834 ... yes
3062/1835 ... yes
931/1837 ... yes
1306/1838 ... yes
574/1839 ... yes
15/1840 ... yes
15/1841 ... yes
22/1842 ... yes
22/1843 ... yes
3062/1844 ... yes
15/1845 ... yes
15/1846 ... yes
1619/1847 ... yes
3508/1848 ... yes
1619/1849 ... yes
269/1851 ... yes
1619/1852 ... yes
3771/1853 ... yes
3771/1854 ... yes
701/1855 ... yes
701/1856 ... yes
3780/1857 ... yes
3780/1858 ... yes
3779/1860 ... yes
3778/1861 ... yes
3778/1862 ... yes
3787/1863 ... yes
3779/1864 ... yes
2990/1865 ... yes
269/1867 ... yes
890/1868 ... yes
3478/1869 ... yes
973/1870 ... yes
701/1872 ... yes
3801/1873 ... yes
3614/1874 ... yes
3776/1876 ... yes
3776/1877 ... yes
3776/1878 ... yes
3776/1879 ... yes
1220/1880 ... yes
2838/1883 ... yes
22/1884 ... yes
2838/1886 ... yes
3086/1888 ... yes
2680/1889 ... yes
2680/1891 ... yes
3086/1892 ... yes
3062/1893 ... yes
22/1894 ... yes
664/1895 ... yes
752/1896 ... yes
3509/1897 ... yes
1421/1900 ... yes
701/1901 ... yes
3086/1902 ... yes
3086/1903 ... yes
3062/1904 ... yes
500/1905 ... yes
701/1906 ... yes
1435/1907 ... yes
3086/1908 ... yes
3834/1911 ... yes
3834/1912 ... yes
3834/1913 ... yes
3834/1914 ... yes
3614/1918 ... yes
346/1919 ... yes
3834/1920 ... yes
3834/1921 ... yes
3834/1924 ... yes
22/1925 ... yes
500/1926 ... yes
3061/1927 ... yes
500/1928 ... yes
269/1929 ... yes
3681/1930 ... yes
3923/1932 ... yes
3923/1933 ... yes
3897/1934 ... yes
3834/1935 ... yes
3923/1936 ... yes
3935/1937 ... yes
3834/1939 ... yes
3655/1940 ... yes
3631/1941 ... yes
807/1943 ... yes
3950/1944 ... yes
3947/1945 ... yes
462/1946 ... yes
3834/1947 ... yes
3037/1948 ... yes
2967/1949 ... yes
752/1950 ... yes
3037/1951 ... yes
3852/1952 ... yes
3834/1954 ... yes
3973/1955 ... yes
3973/1956 ... yes
1619/1957 ... yes
3973/1958 ... yes
3973/1959 ... yes
3973/1960 ... yes
3973/1961 ... yes
3968/1962 ... yes
1573/1963 ... yes
752/1964 ... yes
701/1965 ... yes
3059/1966 ... yes
664/1967 ... yes
2930/1968 ... yes
3064/1969 ... yes
381/1970 ... yes
3061/1973 ... yes
56/1974 ... yes
3776/1976 ... yes
3776/1977 ... yes
752/1978 ... yes
1619/1980 ... yes
269/1981 ... yes
4040/1982 ... yes
4040/1984 ... yes
15/1986 ... yes
3776/1987 ... yes
3776/1988 ... yes
3834/1989 ... yes
701/1990 ... yes
4066/1991 ... yes
1619/1992 ... yes
2939/1993 ... yes
3842/1994 ... yes
3842/1995 ... yes
4072/1996 ... yes
4071/1997 ... yes
4074/1998 ... yes
4076/1999 ... yes
4073/2000 ... yes
2867/2001 ... yes
4109/2002 ... yes
4109/2003 ... yes
4109/2004 ... yes
269/2005 ... yes
3351/2006 ... yes
269/2007 ... yes
3061/2008 ... yes
15/2009 ... yes
3950/2010 ... yes
3478/2011 ... yes
4129/2012 ... yes
4132/2013 ... yes
4132/2014 ... yes
3787/2015 ... yes
701/2016 ... yes
752/2017 ... yes
4074/2018 ... yes
3062/2019 ... yes
1306/2020 ... yes
1306/2021 ... yes
1122/2023 ... yes
3086/2024 ... yes
3037/2025 ... yes
462/2026 ... yes
701/2027 ... yes
15/2028 ... yes
1619/2029 ... yes
807/2030 ... yes
4160/2031 ... yes
4160/2032 ... yes
4153/2033 ... yes
4153/2035 ... yes
4153/2036 ... yes
4153/2037 ... yes
4153/2038 ... yes
3345/2040 ... yes
500/2041 ... yes
4071/2042 ... yes
4071/2043 ... yes
3359/2044 ... yes
701/2045 ... yes
2967/2046 ... yes
269/2048 ... yes
931/2051 ... yes
4071/2053 ... yes
2867/2054 ... yes
4071/2055 ... yes
3037/2056 ... yes
3061/2057 ... yes
701/2058 ... yes
4071/2059 ... yes
701/2060 ... yes
2939/2061 ... yes
3298/2063 ... yes
4153/2064 ... yes
4230/2065 ... yes
3062/2066 ... yes
3054/2067 ... yes
3351/2068 ... yes
701/2069 ... yes
4230/2070 ... yes
2939/2071 ... yes
4230/2072 ... yes
2939/2073 ... yes
2939/2074 ... yes
4153/2075 ... yes
4074/2076 ... yes
3950/2077 ... yes
4253/2080 ... yes
4253/2081 ... yes
808/2083 ... yes
3776/2084 ... yes
4261/2085 ... yes
4261/2086 ... yes
4265/2088 ... yes
4265/2089 ... yes
4269/2091 ... yes
4269/2092 ... yes
4273/2094 ... yes
4273/2095 ... yes
664/2097 ... yes
1193/2099 ... yes
15/2100 ... yes
496/2101 ... yes
496/2102 ... yes
269/2104 ... yes
269/2105 ... yes
496/2106 ... yes
752/2107 ... yes
3062/2108 ... yes
4301/2109 ... yes
4301/2110 ... yes
4312/2111 ... yes
4074/2112 ... yes
3298/2113 ... yes
4320/2116 ... yes
4323/2117 ... yes
4323/2118 ... yes
4323/2119 ... yes
4323/2120 ... yes
269/2121 ... yes
269/2122 ... yes
4339/2123 ... yes
269/2124 ... yes
4383/2125 ... yes
1481/2126 ... yes
4348/2127 ... yes
4365/2128 ... yes
4365/2129 ... yes
3834/2130 ... yes
269/2131 ... yes
269/2132 ... yes
4380/2135 ... yes
5540/2137 ... yes
4426/2141 ... yes
269/2142 ... yes
269/2143 ... yes
5540/2144 ... yes
3935/2147 ... yes
3834/2150 ... yes
4312/2152 ... yes
4312/2153 ... yes
3508/2166 ... yes
3508/2167 ... yes
2967/2169 ... yes
269/2170 ... yes
269/2171 ... yes
4476/2173 ... yes
4474/2174 ... yes
2950/2175 ... yes
4338/2176 ... yes
4486/2177 ... yes
4486/2178 ... yes
4153/2179 ... yes
4153/2180 ... yes
2691/2181 ... yes
346/2182 ... yes
2930/2183 ... yes
4518/2184 ... yes
3834/2186 ... yes
381/2187 ... yes
4153/2188 ... yes
701/2189 ... yes
4518/2190 ... yes
4076/2191 ... yes
3834/2195 ... yes
3834/2196 ... yes
269/2197 ... yes
2945/2198 ... yes
500/2199 ... yes
5540/2200 ... yes
5540/2201 ... yes
490/2202 ... yes
4073/2203 ... yes
499/2204 ... yes
269/2205 ... yes
500/2206 ... yes
4553/2207 ... yes
4153/2208 ... yes
500/2209 ... yes
381/2210 ... yes
4153/2211 ... yes
5540/2212 ... yes
922/2213 ... yes
4577/2214 ... yes
4076/2215 ... yes
701/2216 ... yes
2867/2217 ... yes
4153/2218 ... yes
3298/2219 ... yes
269/2220 ... yes
664/2221 ... yes
701/2223 ... yes
4230/2224 ... yes
4073/2225 ... yes
4628/2230 ... yes
4628/2231 ... yes
4643/2234 ... yes
4643/2235 ... yes
4643/2236 ... yes
4026/2239 ... yes
752/2242 ... yes
701/2243 ... yes
3631/2244 ... yes
3631/2245 ... yes
3631/2246 ... yes
4577/2247 ... yes
4577/2248 ... yes
490/2249 ... yes
1001/2250 ... yes
4253/2251 ... yes
500/2257 ... yes
3062/2258 ... yes
5540/2259 ... yes
4906/2260 ... yes
4383/2262 ... yes
4385/2263 ... yes
500/2264 ... yes
2867/2265 ... yes
4577/2269 ... yes
3298/2270 ... yes
15/2271 ... yes
752/2272 ... yes
884/2273 ... yes
4385/2274 ... yes
269/2275 ... yes
5540/2276 ... yes
4729/2277 ... yes
3923/2279 ... yes
701/2280 ... yes
752/2282 ... yes
407/2283 ... yes
269/2284 ... yes
3834/2285 ... yes
4385/2287 ... yes
2867/2300 ... yes
701/2304 ... yes
2990/2305 ... yes
4789/2306 ... yes
3834/2307 ... yes
931/2308 ... yes
4577/2312 ... yes
5540/2325 ... yes
3064/2326 ... yes
664/2330 ... yes
4381/2331 ... yes
5540/2332 ... yes
4385/2333 ... yes
2961/2334 ... yes
4153/2335 ... yes
884/2336 ... yes
4153/2337 ... yes
2930/2342 ... yes
4577/2343 ... yes
4577/2344 ... yes
3059/2345 ... yes
4825/2346 ... yes
702/2347 ... yes
269/2348 ... yes
4957/2349 ... yes
3078/2350 ... yes
3973/2351 ... yes
3973/2352 ... yes
3834/2353 ... yes
4426/2362 ... yes
4981/2363 ... yes
269/2364 ... yes
3086/2365 ... yes
4981/2429 ... yes
4766/2430 ... yes
4981/2439 ... yes
5540/2480 ... yes
269/2521 ... yes
5188/2523 ... yes
5188/2524 ... yes
5191/2525 ... yes
5191/2526 ... yes
5194/2527 ... yes
5194/2528 ... yes
4385/2529 ... yes
4383/2530 ... yes
5191/2531 ... yes
5191/2532 ... yes
5191/2533 ... yes
923/2534 ... yes
3062/2535 ... yes
6485/2545 ... yes
3062/2546 ... yes
5239/2548 ... yes
5239/2549 ... yes
5242/2550 ... yes
5242/2551 ... yes
5242/2552 ... yes
5242/2553 ... yes
5244/2554 ... yes
5244/2555 ... yes
499/2556 ... yes
5244/2557 ... yes
5233/2558 ... yes
5237/2559 ... yes
5237/2560 ... yes
5234/2561 ... yes
5234/2562 ... yes
5234/2563 ... yes
5234/2564 ... yes
5234/2565 ... yes
5234/2566 ... yes
5234/2567 ... yes
5234/2568 ... yes
499/2569 ... yes
5266/2570 ... yes
5266/2571 ... yes
5266/2572 ... yes
5266/2573 ... yes
5266/2574 ... yes
5266/2577 ... yes
5266/2578 ... yes
5266/2579 ... yes
5266/2580 ... yes
5266/2581 ... yes
5266/2582 ... yes
5281/2583 ... yes
5281/2584 ... yes
5281/2585 ... yes
5281/2586 ... yes
5281/2587 ... yes
5281/2588 ... yes
5281/2589 ... yes
5281/2590 ... yes
5281/2591 ... yes
5292/2592 ... yes
5292/2593 ... yes
5295/2594 ... yes
5295/2595 ... yes
5295/2596 ... yes
5291/2597 ... yes
5291/2598 ... yes
5291/2599 ... yes
206/2600 ... yes
3834/2601 ... yes
5194/2602 ... yes
790/2604 ... yes
269/2605 ... yes
3086/2606 ... yes
3062/2607 ... yes
3062/2608 ... yes
269/2618 ... yes
2838/2619 ... yes
4338/2620 ... yes
15/2621 ... yes
4320/2622 ... yes
433/2623 ... yes
15/2625 ... yes
1091/2626 ... yes
4338/2627 ... yes
1122/2628 ... yes
664/2629 ... yes
664/2630 ... yes
752/2631 ... yes
752/2632 ... yes
664/2633 ... yes
664/2634 ... yes
752/2635 ... yes
490/2636 ... yes
3834/2637 ... yes
3834/2638 ... yes
5375/2639 ... yes
5375/2640 ... yes
5375/2641 ... yes
5375/2642 ... yes
1091/2643 ... yes
3062/2644 ... yes
1091/2645 ... yes
3787/2648 ... yes
1091/2649 ... yes
15/2650 ... yes
3834/2652 ... yes
4887/2653 ... yes
3834/2655 ... yes
3062/2656 ... yes
4384/2658 ... yes
269/2659 ... yes
1091/2660 ... yes
3361/2661 ... yes
4384/2662 ... yes
5430/2666 ... yes
5430/2667 ... yes
5430/2668 ... yes
5430/2670 ... yes
5832/2671 ... yes
5388/2672 ... yes
5388/2673 ... yes
5388/2675 ... yes
4981/2680 ... yes
4981/2681 ... yes
5430/2682 ... yes
5430/2683 ... yes
5430/2684 ... yes
5430/2685 ... yes
5430/2686 ... yes
5430/2687 ... yes
5430/2688 ... yes
5430/2689 ... yes
5430/2690 ... yes
5430/2691 ... yes
5430/2692 ... yes
5430/2693 ... yes
5430/2694 ... yes
5430/2696 ... yes
5430/2697 ... yes
5430/2698 ... yes
5430/2699 ... yes
5430/2700 ... yes
5430/2701 ... yes
5430/2702 ... yes
5430/2703 ... yes
5430/2704 ... yes
5430/2705 ... yes
5430/2706 ... yes
5430/2707 ... yes
4379/2708 ... yes
4378/2709 ... yes
5430/2711 ... yes
15/2712 ... yes
4439/2713 ... yes
4439/2714 ... yes
4385/2715 ... yes
5406/2716 ... yes
5406/2718 ... yes
5516/2719 ... yes
5518/2720 ... yes
5518/2721 ... yes
5518/2722 ... yes
5518/2723 ... yes
3359/2724 ... yes
5388/2725 ... yes
4426/2726 ... yes
4390/2727 ... yes
2867/2730 ... yes
5548/2731 ... yes
3359/2732 ... yes
500/2733 ... yes
5514/2735 ... yes
4426/2736 ... yes
341/2737 ... yes
5557/2739 ... yes
5557/2740 ... yes
5557/2741 ... yes
5557/2742 ... yes
5557/2743 ... yes
4383/2744 ... yes
4338/2745 ... yes
269/2746 ... yes
15/2747 ... yes
3923/2748 ... yes
5514/2749 ... yes
5514/2750 ... yes
5514/2751 ... yes
5589/2752 ... yes
5514/2753 ... yes
3834/2754 ... yes
5430/2755 ... yes
5430/2756 ... yes
499/2757 ... yes
4385/2758 ... yes
15/2759 ... yes
5388/2760 ... yes
2867/2761 ... yes
2867/2762 ... yes
3062/2763 ... yes
5406/2764 ... yes
2867/2765 ... yes
5406/2766 ... yes
5524/2767 ... yes
5406/2768 ... yes
4338/2769 ... yes
931/2770 ... yes
3059/2771 ... yes
5388/2774 ... yes
5523/2776 ... yes
5406/2777 ... yes
4385/2778 ... yes
5763/2813 ... yes
5763/2815 ... yes
5763/2817 ... yes
5763/2818 ... yes
5763/2820 ... yes
5763/2822 ... yes
5763/2824 ... yes
5763/2825 ... yes
5763/2826 ... yes
5763/2827 ... yes
4906/2829 ... yes
4906/2830 ... yes
5791/2831 ... yes
5791/2832 ... yes
5791/2833 ... yes
4338/2834 ... yes
269/2836 ... yes
4981/2837 ... yes
4981/2838 ... yes
5516/2839 ... yes
5516/2840 ... yes
5925/2841 ... yes
3037/2842 ... yes
5514/2843 ... yes
3359/2844 ... yes
4631/2845 ... yes
4633/2846 ... yes
5780/2847 ... yes
4632/2848 ... yes
4642/2849 ... yes
5816/2850 ... yes
5815/2851 ... yes
4981/2852 ... yes
5827/2853 ... yes
5829/2854 ... yes
5406/2855 ... yes
5832/2858 ... yes
5832/2859 ... yes
5763/2860 ... yes
4600/2863 ... yes
5388/2864 ... yes
462/2865 ... yes
5850/2866 ... yes
5850/2867 ... yes
496/2868 ... yes
4981/2871 ... yes
4981/2872 ... yes
5406/2873 ... yes
5548/2874 ... yes
5514/2875 ... yes
5514/2876 ... yes
931/2878 ... yes
5870/2879 ... yes
5870/2880 ... yes
5870/2881 ... yes
5870/2882 ... yes
5870/2883 ... yes
5870/2884 ... yes
5870/2885 ... yes
5870/2886 ... yes
5870/2887 ... yes
5870/2888 ... yes
5870/2889 ... yes
5884/2890 ... yes
5388/2891 ... yes
5850/2892 ... yes
1421/2893 ... yes
3059/2894 ... yes
5406/2895 ... yes
5557/2896 ... yes
15/2897 ... yes
5917/2898 ... yes
490/2899 ... yes
22/2900 ... yes
2990/2901 ... yes
1236/2902 ... yes
701/2903 ... yes
701/2904 ... yes
664/2905 ... yes
5388/2906 ... yes
269/2907 ... yes
5406/2908 ... yes
496/2909 ... yes
2867/2910 ... yes
5998/2911 ... yes
5998/2912 ... yes
5998/2913 ... yes
5998/2914 ... yes
5998/2915 ... yes
5998/2916 ... yes
5998/2917 ... yes
5998/2918 ... yes
5998/2919 ... yes
5998/2920 ... yes
5998/2921 ... yes
5998/2922 ... yes
5998/2923 ... yes
5998/2924 ... yes
5998/2925 ... yes
5998/2926 ... yes
5998/2927 ... yes
5998/2928 ... yes
3095/2929 ... yes
701/2930 ... yes
3681/2931 ... yes
3059/2932 ... yes
6033/2933 ... yes
5406/2934 ... yes
1091/2935 ... yes
490/2936 ... yes
4426/2937 ... yes
6053/2938 ... yes
701/2939 ... yes
3771/2940 ... yes
15/2941 ... yes
4766/2942 ... yes
4981/2943 ... yes
4981/2944 ... yes
5388/2945 ... yes
701/2946 ... yes
6079/2947 ... yes
6079/2948 ... yes
6079/2949 ... yes
6026/2950 ... yes
6026/2951 ... yes
6026/2952 ... yes
5174/2954 ... yes
5174/2955 ... yes
5174/2956 ... yes
369/2957 ... yes
5832/2959 ... yes
15/2960 ... yes
5514/2961 ... yes
5514/2962 ... yes
4906/2963 ... yes
3062/2964 ... yes
6118/2965 ... yes
6118/2966 ... yes
6123/2967 ... yes
3095/2968 ... yes
661/2970 ... yes
15/2971 ... yes
500/2972 ... yes
6118/2973 ... yes
5406/2974 ... yes
1573/2975 ... yes
499/2976 ... yes
5514/2977 ... yes
22/2978 ... yes
664/2979 ... yes
2711/2980 ... yes
701/2981 ... yes
5406/2984 ... yes
701/2985 ... yes
6118/2986 ... yes
701/2987 ... yes
4153/2988 ... yes
500/2989 ... yes
5540/2990 ... yes
5540/2991 ... yes
269/2992 ... yes
4628/2998 ... yes
1306/2999 ... yes
5406/3000 ... yes
6195/3001 ... yes
6195/3002 ... yes
664/3003 ... yes
664/3006 ... yes
2936/3007 ... yes
4379/3008 ... yes
6183/3009 ... yes
496/3010 ... yes
2867/3011 ... yes
5514/3012 ... yes
6225/3013 ... yes
6225/3014 ... yes
6225/3015 ... yes
6225/3016 ... yes
490/3017 ... yes
1091/3018 ... yes
6238/3019 ... yes
6238/3020 ... yes
4261/3022 ... yes
4261/3023 ... yes
6135/3024 ... yes
6123/3025 ... yes
5388/3026 ... yes
776/3027 ... yes
776/3028 ... yes
269/3029 ... yes
6307/3030 ... yes
6292/3033 ... yes
5388/3034 ... yes
3122/3035 ... yes
6303/3036 ... yes
6303/3037 ... yes
490/3038 ... yes
490/3040 ... yes
5406/3041 ... yes
269/3042 ... yes
664/3043 ... yes
6026/3044 ... yes
6026/3045 ... yes
6319/3046 ... yes
6319/3047 ... yes
6319/3049 ... yes
6319/3050 ... yes
6319/3051 ... yes
6319/3052 ... yes
490/3053 ... yes
5388/3054 ... yes
3333/3055 ... yes
3086/3057 ... yes
6307/3058 ... yes
22/3059 ... yes
4981/3060 ... yes
6344/3061 ... yes
6344/3062 ... yes
6344/3063 ... yes
6350/3064 ... yes
6123/3065 ... yes
6292/3066 ... yes
6358/3067 ... yes
6358/3068 ... yes
6358/3069 ... yes
1623/3070 ... yes
6307/3071 ... yes
931/3072 ... yes
346/3073 ... yes
6370/3074 ... yes
6370/3075 ... yes
3086/3076 ... yes
3059/3077 ... yes
6319/3078 ... yes
6358/3079 ... yes
6380/3080 ... yes
6380/3081 ... yes
6380/3082 ... yes
6380/3083 ... yes
5406/3084 ... yes
496/3085 ... yes
6292/3086 ... yes
6344/3087 ... yes
6079/3088 ... yes
6380/3089 ... yes
3333/3090 ... yes
3333/3091 ... yes
341/3092 ... yes
15/3093 ... yes
664/3094 ... yes
269/3095 ... yes
6984/3096 ... yes
69/3097 ... yes
6410/3098 ... yes
490/3099 ... yes
5406/3100 ... yes
4365/3101 ... yes
931/3103 ... yes
22/3104 ... yes
490/3105 ... yes
490/3106 ... yes
490/3107 ... yes
490/3108 ... yes
490/3109 ... yes
490/3110 ... yes
490/3111 ... yes
490/3112 ... yes
490/3113 ... yes
490/3114 ... yes
3037/3115 ... yes
490/3116 ... yes
6307/3117 ... yes
5406/3118 ... yes
6307/3119 ... yes
5514/3120 ... yes
701/3121 ... yes
3834/3122 ... yes
490/3123 ... yes
490/3124 ... yes
490/3125 ... yes
931/3126 ... yes
269/3127 ... yes
5925/3128 ... yes
5917/3129 ... yes
6485/3130 ... yes
4379/3131 ... yes
6485/3132 ... yes
6499/3133 ... yes
6499/3134 ... yes
6499/3135 ... yes
6499/3136 ... yes
6505/3137 ... yes
6505/3138 ... yes
701/3140 ... yes
931/3141 ... yes
269/3142 ... yes
3298/3143 ... yes
341/3144 ... yes
6225/3147 ... yes
3288/3148 ... yes
664/3149 ... yes
4153/3150 ... yes
6528/3151 ... yes
6528/3152 ... yes
6528/3153 ... yes
6528/3154 ... yes
15/3155 ... yes
4339/3156 ... yes
3086/3157 ... yes
6537/3158 ... yes
6424/3159 ... yes
6518/3160 ... yes
269/3161 ... yes
6485/3163 ... yes
5514/3164 ... yes
931/3165 ... yes
5388/3166 ... yes
6551/3167 ... yes
6553/3169 ... yes
15/3171 ... yes
496/3172 ... yes
5514/3173 ... yes
5388/3175 ... yes
937/3176 ... yes
5406/3177 ... yes
5998/3178 ... yes
490/3179 ... yes
3359/3180 ... yes
334/3181 ... yes
3656/3182 ... yes
5514/3183 ... yes
341/3184 ... yes
15/3185 ... yes
4789/3186 ... yes
15/3187 ... yes
269/3188 ... yes
701/3190 ... yes
5917/3192 ... yes
6115/3193 ... yes
269/3194 ... yes
3834/3195 ... yes
6115/3196 ... yes
40/3197 ... yes
6635/3198 ... yes
701/3200 ... yes
269/3201 ... yes
4981/3202 ... yes
96/3203 ... yes
96/3204 ... yes
5998/3205 ... yes
6639/3206 ... yes
6639/3207 ... yes
3288/3208 ... yes
22/3209 ... yes
2734/3210 ... yes
3359/3211 ... yes
40/3212 ... yes
4934/3214 ... yes
6282/3215 ... yes
4934/3216 ... yes
6688/3219 ... yes
6688/3220 ... yes
4934/3221 ... yes
931/3224 ... yes
6712/3225 ... yes
6712/3226 ... yes
22/3227 ... yes
701/3228 ... yes
701/3229 ... yes
701/3230 ... yes
701/3231 ... yes
701/3232 ... yes
701/3233 ... yes
701/3234 ... yes
701/3235 ... yes
701/3236 ... yes
701/3237 ... yes
701/3238 ... yes
701/3239 ... yes
500/3240 ... yes
6424/3241 ... yes
5514/3242 ... yes
15/3244 ... yes
6225/3245 ... yes
6787/3246 ... yes
6787/3247 ... yes
6787/3248 ... yes
6787/3249 ... yes
5763/3250 ... yes
4518/3251 ... yes
5406/3252 ... yes
6798/3253 ... yes
6798/3255 ... yes
6798/3257 ... yes
6798/3259 ... yes
6798/3260 ... yes
6798/3261 ... yes
6798/3262 ... yes
5406/3263 ... yes
6798/3264 ... yes
6798/3265 ... yes
6798/3266 ... yes
5917/3268 ... yes
500/3269 ... yes
4153/3270 ... yes
5870/3271 ... yes
6832/3272 ... yes
6832/3273 ... yes
7315/3274 ... yes
7315/3275 ... yes
6787/3277 ... yes
6787/3278 ... yes
5388/3279 ... yes
269/3281 ... yes
2697/3282 ... yes
6831/3283 ... yes
5191/3284 ... yes
1408/3285 ... yes
15/3286 ... yes
6485/3287 ... yes
6870/3289 ... yes
4628/3290 ... yes
6883/3291 ... yes
6883/3292 ... yes
6883/3293 ... yes
6883/3294 ... yes
6870/3295 ... yes
6870/3296 ... yes
381/3297 ... yes
5406/3298 ... yes
269/3299 ... yes
3062/3300 ... yes
664/3301 ... yes
6870/3302 ... yes
6870/3303 ... yes
6870/3304 ... yes
6870/3305 ... yes
4082/3306 ... yes
6870/3307 ... yes
6870/3308 ... yes
6870/3309 ... yes
6937/3312 ... yes
6937/3313 ... yes
6883/3316 ... yes
6225/3317 ... yes
490/3318 ... yes
341/3319 ... yes
6951/3320 ... yes
6951/3321 ... yes
6951/3322 ... yes
6956/3323 ... yes
6956/3324 ... yes
6956/3325 ... yes
6956/3326 ... yes
6956/3327 ... yes
6962/3328 ... yes
6962/3329 ... yes
6962/3330 ... yes
5514/3331 ... yes
4080/3332 ... yes
6410/3333 ... yes
6424/3334 ... yes
6972/3335 ... yes
6798/3336 ... yes
5917/3337 ... yes
4789/3338 ... yes
6979/3339 ... yes
6979/3341 ... yes
4299/3342 ... yes
701/3343 ... yes
3064/3344 ... yes
500/3345 ... yes
4981/3346 ... yes
6984/3348 ... yes
3086/3349 ... yes
22/3350 ... yes
6319/3351 ... yes
664/3352 ... yes
22/3353 ... yes
6951/3354 ... yes
7007/3355 ... yes
7007/3356 ... yes
5514/3357 ... yes
7007/3358 ... yes
7012/3359 ... yes
7315/3360 ... yes
7012/3361 ... yes
6883/3362 ... yes
2734/3363 ... yes
7022/3364 ... yes
7022/3365 ... yes
334/3367 ... yes
5194/3368 ... yes
5194/3369 ... yes
6319/3370 ... yes
5388/3371 ... yes
6956/3372 ... yes
6319/3373 ... yes
7039/3374 ... yes
7039/3375 ... yes
7039/3376 ... yes
7039/3377 ... yes
3834/3378 ... yes
6319/3379 ... yes
6319/3380 ... yes
4789/3381 ... yes
6319/3382 ... yes
6319/3383 ... yes
4153/3384 ... yes
6319/3385 ... yes
6319/3386 ... yes
6951/3387 ... yes
6979/3388 ... yes
334/3389 ... yes
6410/3390 ... yes
6319/3391 ... yes
6410/3392 ... yes
5406/3393 ... yes
5998/3394 ... yes
6319/3395 ... yes
7050/3397 ... yes
6123/3398 ... yes
334/3399 ... yes
6123/3400 ... yes
4339/3401 ... yes
3062/3402 ... yes
334/3403 ... yes
6123/3404 ... yes
22/3405 ... yes
7007/3406 ... yes
22/3407 ... yes
617/3409 ... yes
269/3410 ... yes
6292/3411 ... yes
3333/3412 ... yes
3359/3413 ... yes
6225/3414 ... yes
6319/3415 ... yes
664/3416 ... yes
499/3417 ... yes
269/3418 ... yes
15/3419 ... yes
334/3420 ... yes
6410/3421 ... yes
334/3422 ... yes
15/3423 ... yes
96/3424 ... yes
5406/3425 ... yes
6410/3426 ... yes
7209/3427 ... yes
7213/3428 ... yes
6798/3429 ... yes
5406/3430 ... yes
5406/3431 ... yes
5191/3432 ... yes
269/3433 ... yes
22/3434 ... yes
4934/3435 ... yes
3013/3436 ... yes
677/3437 ... yes
22/3438 ... yes
6798/3439 ... yes
7246/3441 ... yes
5406/3442 ... yes
334/3445 ... yes
7252/3446 ... yes
22/3447 ... yes
7278/3448 ... yes
4789/3449 ... yes
5221/3450 ... yes
3333/3451 ... yes
5791/3452 ... yes
3288/3453 ... yes
6319/3454 ... yes
6402/3455 ... yes
22/3456 ... yes
7301/3457 ... yes
7301/3458 ... yes
7301/3459 ... yes
7301/3460 ... yes
7301/3461 ... yes
7301/3462 ... yes
7301/3463 ... yes
7301/3464 ... yes
4981/3465 ... yes
5998/3466 ... yes
163/3467 ... yes
269/3468 ... yes
4379/3470 ... yes
22/3471 ... yes
22/3472 ... yes
269/3473 ... yes
776/3474 ... yes
341/3475 ... yes
5514/3476 ... yes
163/3477 ... yes
7405/3478 ... yes
7287/3479 ... yes
6956/3480 ... yes
6956/3481 ... yes
6956/3482 ... yes
6956/3483 ... yes
7405/3484 ... yes
7405/3485 ... yes
6798/3486 ... yes
7362/3487 ... yes
6972/3489 ... yes
7362/3491 ... yes
7351/3492 ... yes
7351/3493 ... yes
7278/3494 ... yes
7351/3495 ... yes
7351/3496 ... yes
7386/3497 ... yes
7386/3498 ... yes
7386/3499 ... yes
7386/3500 ... yes
7386/3501 ... yes
7386/3502 ... yes
7386/3503 ... yes
7386/3504 ... yes
7386/3505 ... yes
7386/3506 ... yes
7386/3507 ... yes
7386/3508 ... yes
5514/3509 ... yes
4766/3510 ... yes
22/3511 ... yes
4365/3514 ... yes
7245/3515 ... yes
7245/3516 ... yes
7245/3517 ... yes
7245/3518 ... yes
7245/3519 ... yes
7245/3520 ... yes
7245/3521 ... yes
7245/3522 ... yes
3062/3524 ... yes
7278/3525 ... yes
6485/3526 ... yes
7386/3527 ... yes
7245/3528 ... yes
7245/3529 ... yes
7245/3530 ... yes
7405/3531 ... yes
7329/3532 ... yes
346/3533 ... yes
7377/3534 ... yes
7405/3535 ... yes
5998/3536 ... yes
7455/3538 ... yes
4981/3539 ... yes
7405/3540 ... yes
7405/3541 ... yes
7405/3542 ... yes
7405/3543 ... yes
7405/3544 ... yes
7405/3545 ... yes
7405/3546 ... yes
269/3547 ... yes
499/3548 ... yes
3520/3549 ... yes
7278/3550 ... yes
7377/3551 ... yes
7209/3552 ... yes
7386/3553 ... yes
7492/3554 ... yes
454/3555 ... yes
490/3556 ... yes
490/3557 ... yes
701/3558 ... yes
701/3559 ... yes
4981/3560 ... yes
7405/3561 ... yes
664/3562 ... yes
884/3563 ... yes
4981/3564 ... yes
7513/3565 ... yes
7513/3566 ... yes
7351/3567 ... yes
677/3568 ... yes
2734/3569 ... yes
Redis version >= 6.2.14? ... yes
Ruby version >= 3.0.6 ? ... yes (3.3.11)
Git user has default SSH configuration? ... yes
Active users: ... 1780
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished
</pre>
</details>
### Possible fixes
The policy is built in `app/controllers/sandbox_controller.rb`:
- `master`: https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/controllers/sandbox_controller.rb
- Method `SandboxController.mermaid_sandbox_directives` hardcodes:
```ruby
'script_src' => "'self' 'unsafe-eval'",
```
- `SandboxController#apply_mermaid_csp` calls `policy.directives.clear` before applying these directives, which is why the policy is independent of the global `content_security_policy` setting and cannot be adjusted via `gitlab.rb`.
Suggested fix: because the iframe runs in an opaque origin, `'self'` is not a reliable source for the same-origin bundle in spec-strict browsers (Safari). The sandbox `script_src` (and `style_src`, for the same reason) should include the instance's own origin **explicitly** — e.g. the scheme+host derived from `Gitlab.config.gitlab.url` — in addition to `'self'`. An explicit host source matches the chunk regardless of the document's opaque origin, restoring rendering in Safari without weakening the sandbox (same origin, just expressed explicitly rather than via `'self'`).
<!-- If you don't have /label privileges, follow up with an issue comment of `@gitlab-bot label ~"type::bug"` -->
issue