-
Task
-
Resolution: Unresolved
-
Minor
Note
While testing this plugin, evaluate whether the third-party libraries in src/main/webapp are compatible with CSP in restrictive mode. The plugin may need to be upgraded from jQuery 1.x to 3.x to fully function in CSP restrictive mode.
Problem
== Inline Script Block
Line: 95
----
<script>
$(function() {
$('.left-nav a').click(function(ev) {
window.location.hash = this.href.replace(/.+\/([^\/]+)\/index\.html/,'$1') + '|default';
loadPage(this.href);
$('.left-nav a.selected').removeClass('selected');
$(this).addClass('selected');
ev.preventDefault();
});
if (window.location.hash) {
if (window.location.hash.indexOf('|') === -1) {
window.location.hash += '|default';
}
var path = window.location.href.replace(/(index\.html)?#/,'');
path = path.replace('\|','/') + '.html';
loadPage(path);
}
function loadPage(path) {
var section = path.replace(/\/[^\/]+\.html/,'');
var header = section.replace(/.+\/([^\/]+)/,'$1').replace(/_/, ' ');
$('td.normal div.normal')
.empty()
.append('<h4 class="demo-subheader">Functional demo:</h4>')
.append('<h3 class="demo-header">'+ header +'</h3>')
.append('<div id="demo-config"></div>')
.find('#demo-config')
.append('<div id="demo-frame"></div><div id="demo-config-menu"></div><div id="demo-link"><a class="demoWindowLink" href="#"><span class="ui-icon ui-icon-newwin"></span>Open demo in a new window</a></div>')
.find('#demo-config-menu')
.load(section + '/index.html .demos-nav', function() {
$('#demo-config-menu a').each(function() {
this.setAttribute('href', section + '/' + this.getAttribute('href').replace(/.+\/([^\/]+)/,'$1'));
$(this).attr('target', 'demo-frame');
$(this).click(function() {
resetDemos();
$(this).parents('ul').find('li').removeClass('demo-config-on');
$(this).parent().addClass('demo-config-on');
$('#demo-notes').fadeOut();
//Set the hash to the actual page without ".html"
window.location.hash = header + '|' + this.getAttribute('href').match((/\/([^\/\\]+)\.html/))[1];
loadDemo(this.getAttribute('href'));
return false;
});
});
if (window.location.hash) {
var demo = window.location.hash.split('|')[1];
$('#demo-config-menu a').each(function(){
if (this.href.indexOf(demo + '.html') !== -1) {
$(this).parents('ul').find('li').removeClass('demo-config-on');
$(this).parent().addClass('demo-config-on');
loadDemo(this.href);
}
});
}
updateDemoNotes();
})
.end()
.find('#demo-link a')
.bind('click', function(ev){
window.open(this.href);
ev.preventDefault();
})
.end()
.end()
;
resetDemos();
}
function loadDemo(path) {
var directory = path.match(/([^\/]+)\/[^\/\.]+\.html$/)[1];
$.get(path, function(data) {
var source = data;
data = data.replace(/<script.*>.*<\/script>/ig,""); // Remove script tags
data = data.replace(/<\/?link.*>/ig,""); //Remove link tags
data = data.replace(/<\/?html.*>/ig,""); //Remove html tag
data = data.replace(/<\/?body.*>/ig,""); //Remove body tag
data = data.replace(/<\/?head.*>/ig,""); //Remove head tag
data = data.replace(/<\/?!doctype.*>/ig,""); //Remove doctype
data = data.replace(/<title.*>.*<\/title>/ig,""); // Remove title tags
data = data.replace(/((href|src)=["'])(?!(http|#))/ig, "$1" + directory + "/");
$('#demo-style').remove();
$('#demo-frame').empty().html(data);
$('#demo-frame style').clone().appendTo('head').attr('id','demo-style');
$('#demo-link a').attr('href', path);
updateDemoNotes();
updateDemoSource(source);
if (/default.html$/.test(path)) {
$.get("documentation/docs-" + path.match(/demos\/(.+)\//)[1] + ".html", function(html) {
$("#demo-source").after(html);
$("#widget-docs").tabs();
$(".param-header").click(function() {
$(this).parent().toggleClass("param-open").end().next().toggle();
});
$(".docs-list-header").each(function() {
var header = $(this);
var details = header.next().find(".param-details").hide();
$("a:first", header).click(function() {
details.show().parent().addClass("param-open");
return false;
});
$("a:last", header).click(function() {
details.hide().parent().removeClass("param-open");
return false;
});
});
});
}
});
}
function updateDemoNotes() {
var notes = $('#demo-frame .demo-description');
if ($('#demo-notes').length == 0) {
$('<div id="demo-notes"></div>').insertAfter('#demo-config');
}
$('#demo-notes').hide().empty().html(notes.html());
$('#demo-notes').show();
notes.hide();
}
function updateDemoSource(source) {
if ($('#demo-source').length == 0) {
$('<div id="demo-source"><a href="#" class="source-closed">View Source</a><div><pre><code></code></pre></div></div>').insertAfter('#demo-notes');
$('#demo-source').find(">a").click(function() {
$(this).toggleClass("source-closed").toggleClass("source-open").next().toggle();
return false;
}).end().find(">div").hide();
}
var cleanedSource = source
.replace('themes/base/jquery.ui.all.css', 'theme/jquery.ui.all.css')
.replace(/\s*\x3Clink.*demos\x2Ecss.*\x3E\s*/, '\r\n\t')
.replace(/\x2E\x2E\x2F\x2E\x2E\x2F/g, '');
$('#demo-source code').empty().text(cleanedSource);
}
function resetDemos() {
$.datepicker.setDefaults($.extend({showMonthAfterYear: false}, $.datepicker.regional['']));
$(".ui-dialog-content").remove();
}
});
</script>
----
Solution
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks