CSP error when clicking on "Create your first Dashboard"

[jezdez]

Issue Summary

When clicking on the "Create your first Dashboard" link after setup I get a CSP error in the browser console.

Steps to Reproduce

1. Setup Redash following the Docker dev docs.
2. Setup a data source (e.g. the postgres container)
3. Add a query
4. Try to click on the "Create your first Dashboard"

I believe the change in 9480d89#diff-90812e4fcbcd1df5f887a43bda5953f5R125 resulted in the code that is run when clicking on the link to be considered inline, instead of the separate function before.

Technical details:

• Redash Version: 8.0.0beta
• Browser/OS: Firefox/macOS 10.14
• How did you install Redash: Docker

[arikfr]

What is the message you receive?

[jezdez]

In Chrome (😬):

"Refused to run the JavaScript URL because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution."

[jezdez]

I think this is about the difference between:

-            onClick={createDashboard}
+            onClick={() => CreateDashboardDialog.showModal()}

[kravets-levko]

@jezdez I think it may happen because of javascript:void(0) in Step component 🤔

[jezdez]

Ah, that could be it?

[kravets-levko]

I think so. If you can experiment with it - try to remove javascript:void(0) there (use null or something like that instead), and check if the issue is still present or fixed.

[arikfr]

@kravets-levko is correct. I will fix it.