-
Type:
Task
-
Resolution: Unresolved
-
Priority:
Minor
-
Component/s: _unsorted
Problem
== Inline Script Block
Line: 370
----
<script type="text/javascript">
// txt is injected after the script opening tag.
const result = JSON.parse(txt);
const counts = {
critical: 0,
high: 0,
medium: 0,
low: 0,
other: 0
};
let set_text = function (id, text) {
document.getElementById(id).innerText = text;
};
let create_column = function (row, text, css) {
const col = document.createElement("td");
const col_span = document.createElement("span");
if (css) {
col_span.className = css.toLowerCase();
}
col_span.innerText = text;
col.appendChild(col_span);
row.appendChild(col);
}
let update_counts = function (severity) {
const sev = severity.toLowerCase()
if (sev in counts) {
counts[sev] += 1;
return sev;
}
counts.other += 1;
return "other";
};
const updated_at = result.updatedAt ? result.updatedAt : new Date().toLocaleString();
const vuln_total = result.vulnerabilities ? result.vulnerabilities.length : 0;
const docker_total = result.docker ? result.docker.length : 0;
const metadata = result.imageMetadata ? result.imageMetadata : {};
let image_sha = metadata.sha ? metadata.sha : "N/A";
let image_name = metadata.id ? metadata.id : "N/A";
image_name = metadata.tags ? `${image_name}:${metadata.tags}` : image_name;
set_text("updated-at", `Updated at ${updated_at}`);
set_text("success-alert", `Image parsed successfully, ${vuln_total + docker_total} findings.`);
set_text("image-name", image_name);
set_text("image-sha", image_sha);
if (result.artifactsPath) {
const button = document.getElementById("download-artifacts")
button.setAttribute("href", result.artifactsPath);
button.style.display = "block";
}
if (vuln_total) {
const vuln_body = document.getElementById("vulnerabilityfindings");
result.vulnerabilities.forEach((finding) => {
const row = document.createElement("tr");
create_column(row, finding.title);
create_column(row, finding.severity, update_counts(finding.severity));
create_column(row, decodeURI(finding.component));
vuln_body.appendChild(row);
});
set_text("vuln-total", `(${vuln_total})`);
document.getElementById("vulnerabilities").style.display = "block";
}
if (docker_total) {
document.getElementById("docker").style.display = "block";
const docker_body = document.getElementById("dockerfindings");
result.docker.forEach((finding) => {
const row = document.createElement("tr");
create_column(row, finding.id);
create_column(row, finding.severity, update_counts(finding.severity));
create_column(row, finding.description);
create_column(row, finding.file)
create_column(row, finding.lines);
docker_body.appendChild(row);
});
set_text("docker-total", `(${docker_total})`);
}
set_text("critical", counts.critical);
set_text("high", counts.high);
set_text("medium", counts.medium);
set_text("low", counts.low);
set_text("other", counts.other);
</script>
----
Solution
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks