-
Task
-
Resolution: Unresolved
-
Minor
Note
While testing this plugin, evaluate whether the third-party libraries in src/main/webapp are compatible with CSP in restrictive mode. The plugin may need to be upgraded from jQuery 1.x to 3.x to fully function in CSP restrictive mode.
Problems
== Inline Script Block Line: 25 ---- <script> jQuery.noConflict(); <!-- To prevent overwriting $ function --> var disablePrototypeJS = function (method, pluginsToDisable) { var handler = function (event) { event.target[method] = undefined; setTimeout(function () { delete event.target[method]; }, 0); }; pluginsToDisable.each(function (plugin) { jQuery(window).on(method + '.bs.' + plugin, handler); }); }, pluginsToDisable = ['collapse', 'dropdown', 'modal', 'tooltip', 'popover', 'tab']; disablePrototypeJS('show', pluginsToDisable); disablePrototypeJS('hide', pluginsToDisable); </script> ---- == Inline Script Block Line: 69 ---- <script type="text/javascript"> buildPolicyEvalSummaryTable("#gates_summary_table", ${it.gateSummary}); </script> ---- == Inline Script Block Line: 78 ---- <script type="text/javascript"> buildPolicyEvalTable("#gates_table", "${it.gateOutputUrl}"); </script> ---- == Inline Script Block Line: 89 ---- <script type="text/javascript"> buildTableFromAnchoreOutput("#query${counter}_table", "${e.value}"); </script> ---- == Inline Script Block Line: 100 ---- <script type="text/javascript"> buildSecurityTable("#security_table", "${it.cveListingUrl}"); </script> ----
Solution
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks