-
Task
-
Resolution: Fixed
-
Minor
-
-
1.14-947.vfec2cf655fe2
Problems
== Inline Script Block Line: 61 ---- <script> window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date; ga('create', 'UA-61694827-4', 'auto', { 'userId': '${it.installation.anonymousCorrelationId()}', 'sampleRate': 1 }); ga('set', { 'forceSSL': true, 'appName': 'Build Monitor', 'appId': 'build-monitor-plugin', 'appVersion': '${it.installation.buildMonitorVersion()}', 'appInstallerId': '${h.version}', 'dimension1': '${it.installation.size()}', 'dimension2': '${it.items.size()}', 'dimension3': '${it.installation.audience()}', 'dimension4': '${it.installation.anonymousCorrelationId()}' }); ga('send', 'screenview', {screenName: 'Dashboard'}); </script> ---- == Inline Script Block Line: 134 ---- <script> /* * todo: (13.08.2013) Replace the below workaround with a custom Jelly tag (ExposeBindTag) * extending either org.kohsuke.stapler.jelly.BindTag or AbstractStaplerTag, * that would supersede currently defective BindTag implementation: * - https://groups.google.com/forum/#!topic/jenkinsci-dev/S9bhX4ts0g4 * - https://issues.jenkins-ci.org/browse/JENKINS-18641 * * Defect in BindTag manifests itself by causing a JavaScript error and preventing scripts after * the <st:bind> invocation from executing, which results in an "empty Build Monitor". * The issue occurs on Jenkins 1.521-1.526, only if the jQuery plugin is used. * * Motivation behind a custom Jelly tag: * Original implementation of the BindTag doesn't provide an easy way of handling AJAX errors, * which may happen if a network connection is lost or when Jenkins is restarted (which then makes * Stapler's binding hash obsolete and Jenkins return 404 for any subsequent requests). * * Custom Jelly tag should generate a JSON object exposing the binding, leaving the implementation * of the proxy to the Developer. It makes more sense for a developer to require a binding adapter * implementation specific to their JavaScript framework of choice, rather than for Stapler to try * to predict what JavaScript libraries will ever be used with it in the future... */ window.originalMakeStaplerProxy = window.makeStaplerProxy; window.makeStaplerProxy = function(url, crumb, methods) { return { url: url, crumb: crumb, methods: methods } }; window.bindings={}; </script> ---- == Inline Script Block Line: 163 ---- <script> window.bindings['buildMonitor'] = buildMonitorBind window.makeStaplerProxy = window.originalMakeStaplerProxy; try { delete window.originalMakeStaplerProxy; } catch(e) { window["originalMakeStaplerProxy"] = undefined; } </script> ---- == Inline Script Block Line: 186 ---- <script> 'use strict'; angular. module('buildMonitor'). constant('BUILD_MONITOR_VERSION', '${it.installation.buildMonitorVersion()}'). constant('CSRF_CRUMB_FIELD_NAME', '${it.csrfCrumbFieldName}'). config(function(proxyProvider, cookieJarProvider, hashCodeProvider) { var hashCodeOf = hashCodeProvider.hashCodeOf; proxyProvider.configureProxiesUsing(window.bindings); cookieJarProvider.describe({ label: 'buildMonitor.' + hashCodeOf(document.body.dataset.displayName), shelfLife: 365 }); }); </script> ----
Solution
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks