fix: Clicking on a link to GitHub fails

[imlakshay08]

Description

For #516

This pull request addresses the issue where clicking on GitHub links was failing due to Content Security Policy (CSP) restrictions.

Checklist

• Run tests locally

[imlakshay08]

Hey @noahgibbs , could you please review and suggest further changes that needs to be done?

[noahgibbs]

Hm. First problem is that it's printing the Proc's to_s right into the Javascript. So that's definitely not working. But I'll mess with it a bit and see if what I was thinking of works in general...

[noahgibbs]

So, I was thinking that we should not change examples/link.rb -- instead when we render links, we could include the navigate() call in JS.

But it looks like we already have an onclick handler, so it's probably easier to use that (and always render it) than to sometimes render the current JS handler and sometimes render the navigate() handler. So I tried messing with that a bit. I reverted examples/link.rb to the old version and did this:

diff --git a/lib/scarpe/wv/link.rb b/lib/scarpe/wv/link.rb
index 96ffe89e..49289542 100644
--- a/lib/scarpe/wv/link.rb
+++ b/lib/scarpe/wv/link.rb
@@ -6,7 +6,11 @@ module Scarpe::Webview
       super

       bind("click") do
-        send_self_event(event_name: "click")
+        if @has_block
+          send_self_event(event_name: "click")
+        else
+          DisplayService.instance.wrangler.navigate_to(@click)
+        end
       end
     end
diff --git a/scarpe-components/lib/scarpe/components/calzini/para.rb b/scarpe-components/lib/scarpe/components/calzini/para.rb
index 8228eb1a..7679f372 100644
--- a/scarpe-components/lib/scarpe/components/calzini/para.rb
+++ b/scarpe-components/lib/scarpe/components/calzini/para.rb
@@ -218,8 +218,8 @@ module Scarpe::Components::Calzini
   def text_drawable_attrs(props)
     {
       # These properties will normally only be set by link()
-      href: props["click"],
-      onclick: props["has_block"] ? handler_js_code("click") : nil,
+      href: "#",
+      onclick: handler_js_code("click"),
     }.compact
   end

Unfortunately I'm still getting the same error: "Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"script-src github.githubassets.com\".\n"

So then the question is: why is this failing this way in Scarpe, but it runs fine in the little test program? I don't have an immediate answer.