-
Task
-
Resolution: Unresolved
-
Minor
Note
While testing this plugin, evaluate whether the third-party libraries in src/main/webapp are compatible with CSP in restrictive mode. The plugin may need to be upgraded from jQuery 1.x to 3.x to fully function in CSP restrictive mode.
Problems
== Inline Script Block Line: 35 ---- <script type="text/javascript"> var $j = jQuery.noConflict(); var colors = ['black','aqua', 'blue', 'fuchsia', 'gray', 'green', 'lime', 'maroon', 'navy', 'olive', 'orange', 'purple', 'red', 'silver', 'teal', 'white', 'yellow']; var plot1 = null; var units = null; $j("#plotcontainer").fadeOut(); function plot(element, unit) { if(plot1 === null) { units = unit; plot1 = new CanvasTimeSeriesPlot(d3.select("#plotcontainer"), [800, 400], { xAxisLabel: "Build", yAxisLabel: units }); } if(element.checked == true) { if(unit === units) { var data = <st:bind value="${it}"/> var color = colors.shift(); colors.push(color); data.getDataPointsOfTest(element.value, unit, function(t) { plot1.addDataSet(element.value, element.value, JSON.parse(t.responseObject()), color, true); }); $j(element).closest('tr').children("#color").css("background-color", color); } else { element.checked = false; alert("You can only compare performance tests for the same units"); return; } } if(element.checked == false) { plot1.removeDataSet(element.value); $j(element).closest('tr').children("#color").css("background-color", ""); } setPlotVisibility(); } function setPlotVisibility() { var numberCheckedCB = $j("table input:checkbox:checked").length; if(numberCheckedCB == 1) { $j("#plotcontainer").fadeIn(); } if(numberCheckedCB == 0) { $j("#plotcontainer").fadeOut(); reset(); } } function reset() { $j("#plotcontainer").empty(); units = null; plot1 = null; } </script> ---- == Inline Event Handler Line: 27 ---- <input type="checkbox" value="${f.displayName}" onchange="plot(this, '${f.unit}')" /> ----
Solutions
https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks
https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers