[JENKINS-60866][JENKINS-71513] Apply Stapler update for CSP-compliant st:bind and renderOnDemand

bom/pom.xml

@@ -40,7 +40,8 @@ THE SOFTWARE.
   <properties>
     <asm.version>9.5</asm.version>
     <slf4jVersion>2.0.7</slf4jVersion>
-    <stapler.version>1802.v9e2750160d01</stapler.version>
+    <!-- TODO https://github.com/jenkinsci/stapler/pull/385 -->
+    <stapler.version>1819.v7d73b_0b_a_cc5b_</stapler.version>
     <groovy.version>2.4.21</groovy.version>
   </properties>
 

core/src/main/java/hudson/Functions.java

@@ -2227,6 +2227,13 @@ public static String createRenderOnDemandProxy(JellyContext context, String attr
         return Stapler.getCurrentRequest().createJavaScriptProxy(new RenderOnDemandClosure(context, attributesToCapture));
     }
 
+    /**
+     * @since TODO
+     */
+    public static StaplerRequest.RenderOnDemandParameters createRenderOnDemandProxyParameters(JellyContext context, String attributesToCapture) {
+        return Stapler.getCurrentRequest().createJavaScriptProxyParameters(new RenderOnDemandClosure(context, attributesToCapture));
+    }
+
     public static String getCurrentDescriptorByNameUrl() {
         return Descriptor.getCurrentDescriptorByNameUrl();
     }

core/src/main/resources/lib/layout/renderOnDemand.jelly

@@ -36,8 +36,12 @@ THE SOFTWARE.
     </st:attribute>
   </st:documentation>
 
+  <j:set var="parameters" value="${h.createRenderOnDemandProxyParameters(context,attrs.capture)}"/>
   <x:element name="${attrs.tag?:'div'}">
     <x:attribute name="class">render-on-demand ${attrs.clazz}</x:attribute>
-    <x:attribute name="proxy">${h.createRenderOnDemandProxy(context,attrs.capture)}</x:attribute>
+    <x:attribute name="data-proxy-method">${parameters.proxyMethod}</x:attribute>
+    <x:attribute name="data-proxy-url">${parameters.url}</x:attribute>
+    <x:attribute name="data-proxy-crumb">${parameters.crumb}</x:attribute>
+    <x:attribute name="data-proxy-args">${parameters.methodsString}</x:attribute>
   </x:element>
 </j:jelly>

war/src/main/webapp/scripts/hudson-behavior.js

@@ -1001,7 +1001,13 @@ function renderOnDemand(e, callback, noBehaviour) {
   if (!e || !e.classList.contains("render-on-demand")) {
     return;
   }
-  var proxy = eval(e.getAttribute("proxy"));
+
+  let proxyMethod = e.getAttribute("data-proxy-method");
+  let proxyUrl = e.getAttribute("data-proxy-url");
+  let proxyCrumb = e.getAttribute("data-proxy-crumb");
+  let proxyMethods = e.getAttribute("data-proxy-args").split(",");
+
+  var proxy = window[proxyMethod](proxyUrl, proxyCrumb, proxyMethods);
   proxy.render(function (t) {
     var contextTagName = e.parentNode.tagName;
     var c;