[JENKINS-74891] [email-ext] CSP compliance for EmailExtTemplateAction

[jenkins-infra-bot]

Problem

email-ext-plugin/src/main/resources/hudson/plugins/emailext/EmailExtTemplateAction/index.groovy

Lines 16 to 31 in 5916ca2

	st.bind(var: "templateTester", value: my)
	script """function onSubmit() {
	var templateFile = document.getElementById('template_file_name').value;
	var buildId = document.getElementById('template_build').value;
	templateTester.renderTemplate(templateFile,buildId, function(t) {
	document.getElementById('rendered_template').src = "data:text/html;charset=utf-8," + escape(t.responseObject()[0]);
	var consoleOutput = t.responseObject()[1];
	if(consoleOutput.length == 0) {
	document.getElementById('output').style.display = 'none';
	} else {
	document.getElementById('output').style.display = 'block';
	document.getElementById('console_output').innerHTML = consoleOutput;
	}
	});
	return false;
	}"""

Solution

https://www.jenkins.io/doc/developer/security/csp/

---

Originally reported by basil, imported from: [email-ext] CSP compliance for EmailExtTemplateAction

• assignee: yafenkin
• status: In Review
• priority: Minor
• component(s): email-ext-plugin
• label(s): CSP
• resolution: Unresolved
• votes: 0
• watchers: 2
• imported: 20251211-193728

Raw content of original issue

Problem


  

    

      email-ext-plugin/src/main/resources/hudson/plugins/emailext/EmailExtTemplateAction/index.groovy
    
    

        Lines 16 to 31
      in
      5916ca2
    
  
  

    


        

          

          
         st.bind(var: "templateTester", value: my) 
        

        

          

          
         script """function onSubmit() { 
        

        

          

          
                 var templateFile = document.getElementById('template_file_name').value; 
        

        

          

          
                 var buildId = document.getElementById('template_build').value; 
        

        

          

          
                 templateTester.renderTemplate(templateFile,buildId, function(t) { 
        

        

          

          
                     document.getElementById('rendered_template').src = "data:text/html;charset=utf-8," + escape(t.responseObject()[0]); 
        

        

          

          
                     var consoleOutput = t.responseObject()[1]; 
        

        

          

          
                     if(consoleOutput.length == 0) { 
        

        

          

          
                         document.getElementById('output').style.display = 'none';                         
        

        

          

          
                     } else { 
        

        

          

          
                         document.getElementById('output').style.display = 'block'; 
        

        

          

          
                         document.getElementById('console_output').innerHTML = consoleOutput; 
        

        

          

          
                     } 
        

        

          

          
                 }); 
        

        

          

          
                 return false; 
        

        

          

          
             }""" 
        
    
  



Solution

https://www.jenkins.io/doc/developer/security/csp/

[jenkins-infra-bot]

• Remote link associated with this issue:

  • jenkinsci/email-ext-plugin/pull/569

[jenkins-infra-bot]

yafenkin:

• Original comment link
• Raw content of original comment:

  Hey slide_o_mix, I see that you've assigned yourself to the issue. Does that imply you're intending to work on the fix soon? This issue is pretty high on our priority list for the CSP project, so I could take care of it unless you've already started looking into it.
  

Hey slide_o_mix, I see that you've assigned yourself to the issue. Does that imply you're intending to work on the fix soon? This issue is pretty high on our priority list for the CSP project, so I could take care of it unless you've already started looking into it.