-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[JENKINS-60866] Add initial guidelines how to make code compatible with CSP #5301
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added some stylistic suggestions, but I also noticed one typo.
To parse JSON, use `JSON.parse` instead. | ||
See https://github.com/jenkinsci/jenkins/pull/6868[jenkinsci/jenkins#6868] for an example. | ||
|
||
To invoke a callback, have the caller define a global function and pass its name as an argument. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Having to define globals seems awkward. Do you have an example of this case?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
var foo = function() { … }
(or let foo = function() { … }
) outside any block makes it global scoped (or, since it's functions, function foobar() { … }
).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, I just meant that the general scenario of when you would need to do this is not really clear to me.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's the part of jenkinsci/jenkins#6865 related to renderOnDemand.jelly
.
Co-authored-by: Devin Nusbaum <[email protected]>
I think this is enough of an improvement to justify the merge, especially with the review from @dwnusbaum |
Better than nothing I guess?
Preview: https://deploy-preview-5301--jenkins-io-site-pr.netlify.app/doc/developer/security/csp/