Critical error 'Area code is not set' occuring in Flancer32\Csp\Plugin\Magento\Csp\Observer\Render::getReportUri

[Djohn12]

Hello,

currently using flancer32/mage2_ext_csp:0.0.6 on magento enterprise version 2.3.6

I find we have multiple reports generated in var/report/ folder :

{
"0": "Area code is not set",
"1": "#1 Flancer32\Csp\Plugin\Magento\Csp\Observer\Render->getReportUri() called at [vendor/flancer32/mage2_ext_csp/Plugin/Magento/Csp/Observer/Render.php:89]\n#2 Flancer32\Csp\Plugin\Magento\Csp\Observer\Render->setupReporting() called at [vendor/flancer32/mage2_ext_csp/Plugin/Magento/Csp/Observer/Render.php:64]\n#3 Flancer32\Csp\Plugin\Magento\Csp\Observer\Render->aroundExecute() called at [vendor/magento/framework/Interception/Interceptor.php:135]\n#4 Magento\Csp\Observer\Render\Interceptor->Magento\Framework\Interception\{closure}() called at [vendor/magento/framework/Interception/Interceptor.php:153]\n#5 Magento\Csp\Observer\Render\Interceptor->___callPlugins() called at [generated/code/Magento/Csp/Observer/Render/Interceptor.php:26]\n#6 Magento\Csp\Observer\Render\Interceptor->execute() called at [vendor/magento/framework/Event/Invoker/InvokerDefault.php:88]\n#7 Magento\Framework\Event\Invoker\InvokerDefault->_callObserverMethod() called at [vendor/magento/framework/Event/Invoker/InvokerDefault.php:74]\n#8 Magento\Framework\Event\Invoker\InvokerDefault->dispatch() called at [vendor/magento/framework/Event/Manager.php:66]\n#9 Magento\Framework\Event\Manager->dispatch() called at [vendor/magento/framework/App/Http.php:131]\n#10 Magento\Framework\App\Http->launch() called at [vendor/magento/framework/App/Bootstrap.php:261]\n#11 Magento\Framework\App\Bootstrap->run() called at [pub/index.php:40]\n"
"report_id": "ef8a25cf33b2e5578c8436873ee94833b5c6e43f933a4dfc79cb9e93636d28ef"
}

It's caused by Flancer32\Csp\Plugin\Magento\Csp\Observer\Render::getReportUri

$area = $this->state->getAreaCode();
if ($area === \Magento\Framework\App\Area::AREA_ADMINHTML) {
    $result = $this->urlBack->getUrl(Cfg::ROUTE_REPORT);
} else {
    $result = $this->urlFront->getUrl(Cfg::ROUTE_REPORT);
}
return $result;

State object throws an exception on getAreaCode() if area code is not set yet.

I don't see any consequences except for the CSP report not to be generated and logs being written.

We could maybe add a protection on this call and have a default case (i.e. ADMIN or STOREFRONT by default) if area code is not set ?

Let me know what you think,
best regards