-
Task
-
Resolution: Unresolved
-
Minor
Problems
== Inline Script Block Line: 23 ---- <script language="javascript"> /* from: http://stackoverflow.com/questions/868407/hide-an-elements-next-sibling-with-javascript Credit to John Resig for this function taken from Pro JavaScript techniques */ function next(elem) { do { elem = elem.nextSibling; } while (elem && elem.nodeType != 1); return elem; } function validateUrl(str) { //return URI_FORMAT_REGEX.test(str); //var pattern = new RegExp("/^(ht|f)tps?:\/\/[a-z0-9-\.]+\.[a-z]{2,4}\/?([^\s<>\#%"\,\{\}\\|\\\^\[\]`]+)?$/"); var pattern = new RegExp("^(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\'\/\\\+&%\$#_]*)?$"); return str.match(pattern); } function validateUserInput(element) { var errorHolder = next(element); while (errorHolder.hasChildNodes()) { errorHolder.removeChild(errorHolder.lastChild); } if (!validateUrl(element.value)) { var errorMessage = document.createTextNode('warning: ' + element.value + ' is not a valid URL.'); errorHolder.appendChild(errorMessage); } } </script> ---- == Inline Script Block Line: 125 ---- <script language="JavaScript" type="text/javascript"> var inputs = document.getElementsByTagName("input"); var i; for (i = 0 ; i < inputs.length ; i++) { var userInput = inputs[i]; if (userInput.name && (userInput.name.indexOf("hostUrl")!= -1)) { validateUserInput(userInput); } } </script> ---- == Legacy checkUrl Line: 86 ---- checkUrl="'descriptorByName/OOBuildStep/checkKeystorePath?value='+escape(this.value)" ---- == Legacy checkUrl Line: 90 ---- checkUrl="'descriptorByName/OOBuildStep/checkKeystorePassword?value='+escape(this.value)+'&path='+escape(document.getElementById('oo.keystore.path').value)" ---- == Inline Event Handler Line: 102 ---- <f:textbox value="${ooServer.getUrl()}" onchange="validateUserInput(this);" onkeyup="validateUserInput(this);"/> ----
Solutions
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks
https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers
https://www.jenkins.io/doc/developer/security/csp/#legacy-javascript-checkurl-validation