Do not parse developer flags if empty (#19097)

* Do not parse developer flags if empty

Attempting to parse an empty flag would
result in a spurious log line which would
clog up the console.

```release-note
NONE
```

* add test

```release-note
NONE
```

web/handlers.go

@@ -100,26 +100,28 @@ func generateDevCSP(c Context) string {
 	}
 
 	// Add supported flags for debugging during development, even if not on a dev build.
-	for _, devFlagKVStr := range strings.Split(*c.App.Config().ServiceSettings.DeveloperFlags, ",") {
-		devFlagKVSplit := strings.SplitN(devFlagKVStr, "=", 2)
-		if len(devFlagKVSplit) != 2 {
-			c.Logger.Warn("Unable to parse developer flag", mlog.String("developer_flag", devFlagKVStr))
-			continue
-		}
-		devFlagKey := devFlagKVSplit[0]
-		devFlagValue := devFlagKVSplit[1]
+	if *c.App.Config().ServiceSettings.DeveloperFlags != "" {
+		for _, devFlagKVStr := range strings.Split(*c.App.Config().ServiceSettings.DeveloperFlags, ",") {
+			devFlagKVSplit := strings.SplitN(devFlagKVStr, "=", 2)
+			if len(devFlagKVSplit) != 2 {
+				c.Logger.Warn("Unable to parse developer flag", mlog.String("developer_flag", devFlagKVStr))
+				continue
+			}
+			devFlagKey := devFlagKVSplit[0]
+			devFlagValue := devFlagKVSplit[1]
 
-		// Ignore disabled keys
-		if devFlagValue != "true" {
-			continue
-		}
+			// Ignore disabled keys
+			if devFlagValue != "true" {
+				continue
+			}
 
-		// Honour only supported keys
-		switch devFlagKey {
-		case "unsafe-eval", "unsafe-inline":
-			devCSPMap[devFlagKey] = true
-		default:
-			c.Logger.Warn("Unrecognized developer flag", mlog.String("developer_flag", devFlagKVStr))
+			// Honour only supported keys
+			switch devFlagKey {
+			case "unsafe-eval", "unsafe-inline":
+				devCSPMap[devFlagKey] = true
+			default:
+				c.Logger.Warn("Unrecognized developer flag", mlog.String("developer_flag", devFlagKVStr))
+			}
 		}
 	}
 	var devCSP string

web/handlers_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/mattermost/mattermost-server/v6/app"
 	"github.com/mattermost/mattermost-server/v6/model"
 	"github.com/mattermost/mattermost-server/v6/plugin/plugintest/mock"
+	"github.com/mattermost/mattermost-server/v6/shared/mlog"
 	"github.com/mattermost/mattermost-server/v6/store/storetest/mocks"
 )
 
@@ -485,6 +486,31 @@ func TestGenerateDevCSP(t *testing.T) {
 
 		assert.Equal(t, " 'unsafe-eval'", devCSP)
 	})
+
+	t.Run("empty dev flags", func(t *testing.T) {
+		th := Setup(t)
+		defer th.TearDown()
+
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.ServiceSettings.DeveloperFlags = ""
+		})
+
+		logger := mlog.CreateConsoleTestLogger(false, mlog.LvlWarn)
+		buf := &mlog.Buffer{}
+		require.NoError(t, mlog.AddWriterTarget(logger, buf, false, mlog.LvlWarn))
+
+		c := &Context{
+			App:        th.App,
+			AppContext: th.Context,
+			Logger:     logger,
+		}
+
+		generateDevCSP(*c)
+
+		require.NoError(t, logger.Shutdown())
+
+		assert.Equal(t, "", buf.String())
+	})
 }
 
 func TestHandlerServeInvalidToken(t *testing.T) {