Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-72788

[github] Un-inlining JS in GitHubPushTrigger/config.groovy

XMLWordPrintable

    • 1.40.0

      Level easy
      Skills a bit of JavaScript, a bit of Groovy

      https://github.com/jenkinsci/github-plugin/blob/bda9cc0c37dc557d9a1e6e2cbd1684eee205c25d/src/main/resources/com/cloudbees/jenkins/GitHubPushTrigger/config.groovy#L12-L19 contains inline javascript.

      Reproduction steps

      • Install GitHub or clone https://github.com/jenkinsci/github-plugin and then mvn hpi:run
      • Create a freestyle project
      • You should be able to view the script on the configuration page
      • Check "GitHub hook trigger for GITScm polling" in the "Build Triggers" section
      • Reload the page
      • It should periodically send request to the "checkHookRegistered" endpoint

      Proposal

      https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks

      Testing notes

       - Ensure to reproduce the feature before any change
       - Ensure that you reproduce the feature after you have made the change

        1. doCheckHookRegistered.png
          doCheckHookRegistered.png
          32 kB
        2. inlineJS.png
          inlineJS.png
          60 kB

          [JENKINS-72788] [github] Un-inlining JS in GitHubPushTrigger/config.groovy

          Yaroslav Afenkin created issue -
          Kevin Guerroudj made changes -
          Summary Original: [giithub] Un-inlining JS in GitHubPushTrigger/config.groovy New: [github] Un-inlining JS in GitHubPushTrigger/config.groovy
          Kevin Guerroudj made changes -
          Description Original: [https://github.com/jenkinsci/github-plugin/blob/bda9cc0c37dc557d9a1e6e2cbd1684eee205c25d/src/main/resources/com/cloudbees/jenkins/GitHubPushTrigger/config.groovy#L12-L19] contains inline javascript. New: |Level|*easy*|
          |Skills|a bit of JavaScript, a bit of Groovy|

          [https://github.com/jenkinsci/github-plugin/blob/bda9cc0c37dc557d9a1e6e2cbd1684eee205c25d/src/main/resources/com/cloudbees/jenkins/GitHubPushTrigger/config.groovy#L12-L19] contains inline javascript.

          h4.Reproduction steps
          - Install [GitHub|https://plugins.jenkins.io/github/] or clone [https://github.com/jenkinsci/github-plugin] and then {{mvn hpi:run}}
          - Create a freestyle project
          - You should be able to view the script on the configuration page
          - Check "GitHub hook trigger for GITScm polling" in the "Build Triggers" section
          - Reload the page
          - It should periodically send request to the "checkHookRegistered" endpoint

          h4.Proposal
          https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks

          h4.Testing notes
           - Ensure to reproduce the feature before any change
           - Ensure that you reproduce the feature after you have made the change
          Labels New: hacktoberfest newbie-friendly
          Kevin Guerroudj made changes -
          Attachment New: doCheckHookRegistered.png [ 62183 ]
          Attachment New: inlineJS.png [ 62184 ]
          Mark Waite made changes -
          Labels Original: hacktoberfest newbie-friendly New: newbie-friendly
          Harsh made changes -
          Assignee Original: Kirill Merkushev [ lanwen ] New: Harsh [ harsh_1806 ]
          Harsh made changes -
          Assignee Original: Harsh [ harsh_1806 ]

          Ivona added a comment -

          Is this issue fixed? 

          The config.groovy file from a cloned repo is different from the one provided as a link.  

          Ivona added a comment - Is this issue fixed?  The config.groovy file from a cloned repo is different from the one provided as a link.  

          Yaroslav Afenkin added a comment -

          Seems to be fixed by https://github.com/jenkinsci/github-plugin/pull/383.
          Nothing indicates that PR was reviewed though, so I'll try to check it tomorrow & close the issue if everything is OK.

          Yaroslav Afenkin added a comment - Seems to be fixed by https://github.com/jenkinsci/github-plugin/pull/383 . Nothing indicates that PR was reviewed though, so I'll try to check it tomorrow & close the issue if everything is OK.
          Yaroslav Afenkin made changes -
          Remote Link New: This issue links to "jenkinsci/github-plugin/pull/383 (Web Link)" [ 30031 ]

            Unassigned Unassigned
            yafenkin Yaroslav Afenkin
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: