-
Task
-
Resolution: Unresolved
-
Minor
Note
While testing this plugin, evaluate whether the third-party libraries in src/main/webapp are compatible with CSP in restrictive mode. The plugin may need to be upgraded from jQuery 1.x to 3.x to fully function in CSP restrictive mode.
Problems
== Inline Script Block Line: 3 ---- <script type="text/javascript"> var http; function test(id,value){ var path= this.location.href; path = path.substring(7); path = path.substring(0,path.indexOf("/")+1); path = "http://"+path; var trid=id; var trvalue=value; if(window.ActiveXObject){ try { alert("ie"); http= new ActiveXObject("Msxml2.XMLHTTP") ; } catch (e) { try { alert("ie2"); http= new ActiveXObject("Microsoft.XMLHTTP") ; } catch (e2) { ; } } } else if(window.XMLHttpRequest){ http= new XMLHttpRequest() ; } var url = path+"controller/off?id="+trid+"&name="+trvalue; url = encodeURI(url); url = encodeURI(url); http.open("GET",url,true); http.setRequestHeader("Content-Type","application/x-www-form-urlencoded"); http.onreadystatechange = callback; http.send(null); http.close(); } function callback(){ if(http.readyState==4){ var responseText = http.responseText; alert(responseText); } } function Ajax(){ var path= this.location.href; path = path.substring(7); path = path.substring(0,path.indexOf("/")+1); path = "http://"+path; var xmlHttp; try{ xmlHttp=new XMLHttpRequest(); } catch (e){ try{ xmlHttp=new ActiveXObject("Msxml2.XMLHTTP"); } catch (e){ try{ xmlHttp=new ActiveXObject("Microsoft.XMLHTTP"); } catch (e){ alert("No AJAX!?"); return false; } } } xmlHttp.onreadystatechange=function(){ if(xmlHttp.readyState==4){ var responseText= xmlHttp.responseText; var s = responseText.replace('[','').replace(']','').split(','); var count=s.length; var i=1; var label; var lbs = document.getElementsByTagName("label"); for(var j=0;j${%lessThan}count-1;j++){ var name= i; name = name.toString(); document.getElementById(name).value=s[j]; j++; document.getElementById("ip"+name).innerHTML=s[j]; j++; document.getElementById("mac"+name).innerHTML=s[j]; i++; } setTimeout('Ajax()',1000); } } var url= path+"controller/refresh"; xmlHttp.open("GET",url,true); xmlHttp.send(null); } setTimeout('Ajax()',1000); </script> ---- == Inline Event Handler Line: 125 ---- <input type="button" value="${it.state[status.count-1]}" id="${status.count}" name="${status.count}" onClick= "test(this.id,this.value)" /> ----
Solutions
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks
https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers