[JENKINS-74067] Extract inline JavaScript from BuildMonitorView/index.jelly
#1034
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
https://issues.jenkins.io/browse/JENKINS-74067
Testing done
Content Security Policy does not catch the violations on pages without
l:layout
, so I'm not relying on it here. I've tried manually adding the header on top of the file by adding the following:Page obviously just falls apart with that header set because of inline scripts.
On the screen recording I'm demonstrating the replacement of
makeStaplerProxy
by the plugin (for whetaver reason it needs it, angularJS I guess), and showing plugin's basic behaviour like monitoring build statuses and showing build progress.Before the fix
With the fix we're able to set the CSP rule as shown above and test with it. I've demonstrated that
makeStaplerProxy
is replaced in the same way as before the fix. And showing that all the build monitoring stuff still works with CSP header set.After the fix
For Google Analytics script I've missed it when recording initially, so covered it separately:
Before the fix
After the fix
Submitter checklist