Skip to content

[JENKINS-60866] Make st:bind tag and JavaScript proxy work without inline JS - #385

Merged
daniel-beck merged 31 commits into
jenkinsci:masterfrom
daniel-beck:csp
Feb 14, 2024
Merged

[JENKINS-60866] Make st:bind tag and JavaScript proxy work without inline JS#385
daniel-beck merged 31 commits into
jenkinsci:masterfrom
daniel-beck:csp

Conversation

@daniel-beck

@daniel-beck daniel-beck commented Jul 16, 2022

Copy link
Copy Markdown
Member

See JENKINS-60866.

Currently, st:bind generates inline JS. This doesn't work with CSP, so move that out.

Additionally, add a new StaplerRequest#createJavaScriptProxyParameters as replacement for StaplerRequest#createJavaScriptProxy that can be used without needing to eval the result.

Downstream PR: jenkinsci/jenkins#6865

@daniel-beck
daniel-beck requested a review from Wadeck July 16, 2022 21:28
@daniel-beck daniel-beck changed the title [JENKINS-60866] Make st:bind tag work without inline JS [JENKINS-60866] Make st:bind tag and JavaScript proxy work without inline JS Jul 17, 2022
Comment thread jelly/src/main/java/org/kohsuke/stapler/jelly/BindTag.java Outdated
Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java Outdated

@jglick jglick left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not recall well enough how st:bind works to offer a meaningful review

Comment thread core/src/main/java/org/kohsuke/stapler/StaplerRequest.java Outdated
@daniel-beck

This comment was marked as resolved.

@Wadeck

This comment was marked as resolved.

@timja

This comment was marked as resolved.

@daniel-beck

This comment was marked as resolved.

@daniel-beck

This comment was marked as resolved.

@daniel-beck
daniel-beck marked this pull request as ready for review August 14, 2023 10:00

@jglick jglick left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure I follow well enough to review seriously.

Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java Outdated
Comment thread jelly/src/main/java/org/kohsuke/stapler/jelly/BindTag.java Outdated
@daniel-beck

This comment was marked as resolved.

@daniel-beck
daniel-beck marked this pull request as draft August 14, 2023 20:51
Comment thread core/src/main/java/org/kohsuke/stapler/bind/BoundObjectTable.java
@daniel-beck
daniel-beck marked this pull request as draft August 22, 2023 17:21
@daniel-beck
daniel-beck marked this pull request as ready for review August 25, 2023 09:32

@timja timja left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jglick jglick left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Presuming someone else has done code review & testing on this & downstream, do you need a merge & release? It is not clear to me whether this is still a WiP or ready to go.

Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java Outdated
Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java Outdated
@daniel-beck

Copy link
Copy Markdown
Member Author

do you need a merge & release? It is not clear to me whether this is still a WiP or ready to go.

Thanks, just no good time IMO in the recent weeks. I'd like to be around for post-release support and ideally not simultaneously with another Stapler release.

@daniel-beck
daniel-beck requested a review from timja February 13, 2024 08:35
@daniel-beck

Copy link
Copy Markdown
Member Author

Last call for reviews :)

@jglick jglick left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Superficial comments, since I do not remember much about this system.

Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java Outdated
Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java Outdated
Comment thread core/src/main/java/org/kohsuke/stapler/bind/Bound.java
Comment thread jelly/src/main/java/org/kohsuke/stapler/jelly/BindTag.java Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

stapler:bind is creating inline javascript

6 participants