Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove inline js from checkUrl #540

Merged
merged 1 commit into from
Aug 27, 2024
Merged

Conversation

mawinter69
Copy link
Contributor

remove fetching the field value via javascript and set the checkDependsOn attribute. This avoids that core interprets the code as javascript and calls eval on the url which is a violation of CSP rules.

Testing done

Manual testing by visiting the corresponding pages and entering invalid data. Validation error is still shown.
With CSP plugin installed there is nothing reported anymore.

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests - that demonstrates feature works or fixes the issue

remove fetching the field value via javascript and set the
checkDependsOn attribute. This avoids that core interprets the code as
javascript and calls eval on the url.
@mawinter69 mawinter69 requested a review from a team as a code owner August 26, 2024 19:18
@slide slide merged commit 9fff0ca into jenkinsci:master Aug 27, 2024
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants