[JENKINS-60866][JENKINS-71513] Apply Stapler update for CSP-compliant st:bind and renderOnDemand #6865

daniel-beck · 2022-07-16T21:45:19Z

This takes care of two different previously inline or eval'ed JS snippets that ended up calling makeStaplerProxy to bind objects to JS:

st:bind emitted a script tag with inline script that assigns the result of makeStaplerProxy to a variable (if used with a variable name -- the other mode cannot be fixed, as it's intended for nesting in an inline script).
renderOnDemand.jelly added the makeStaplerProxy call it needed to an HTML attribute, later eval'ing it in

jenkins/war/src/main/webapp/scripts/hudson-behavior.js

Line 793 in d977ee8

var proxy = eval(e.getAttribute("proxy"));

This PR changes Stapler and Jenkins to no longer need either:

st:bind now emits script tags with src. Stapler has been improved to have a separate URL that provides the previously inline script standalone.
renderOnDemand now adds HTML attributes for the function name and its argument values, which are then read in hudson-behavior.js and used to invoke the specified method with the correct arguments.

Testing notes

st:bind is used in core by progressiveRendering, which is used by the "Build History" view.
renderOnDemand is used whenever a form has nontrivial dynamic content (e.g. adding build steps to a freestyle job, or the configuration of a security realm, authorization strategy, or markup formatter after selecting the type in a dropdown box.

Proposed changelog entries

Developer: Update Stapler from 1822.v120278426e1c to 1839.ved17667b_a_eb_5 to no longer generate line JavaScript with Stapler bound objects to improve compatibility with Content-Security-Policy Plugin

Proposed upgrade guidelines

N/A

Submitter checklist

(If applicable) Jira issue is well described
Changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developer, depending on the change) and are in the imperative mood. Examples
- Fill-in the Proposed changelog entries section only if there are breaking changes or other changes which may require extra steps from users during the upgrade
Appropriate autotests or explanation to why this change has no tests
New public classes, fields, and methods are annotated with @Restricted or have @since TODO Javadoc, as appropriate.
New deprecations are annotated with @Deprecated(since = "TODO") or @Deprecated(forRemoval = true, since = "TODO") if applicable.
For dependency updates: links to external changelogs and, if possible, full diffs

Desired reviewers

@mention

Maintainer checklist

Before the changes are marked as ready-for-merge:

There are at least 2 approvals for the pull request and no outstanding requests for change
Conversations in the pull request are over OR it is explicit that a reviewer does not block the change
Changelog entries in the PR title and/or Proposed changelog entries are accurate, human-readable, and in the imperative mood
Proper changelog labels are set so that the changelog can be generated automatically
If the change needs additional upgrade steps from users, upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the PR title. (example)
If it would make sense to backport the change to LTS, a Jira issue must exist, be a Bug or Improvement, and be labeled as lts-candidate to be considered (see query).

daniel-beck · 2022-07-17T10:44:29Z

Looks like the default branch of Stapler with a bunch of unreleased commits (for incrementals) is incompatible with core. Nice.

[2022-07-17T10:08:49.977Z] [INFO] --- maven-enforcer-plugin:3.1.0:enforce (display-info) @ jenkins-war ---
[2022-07-17T10:08:49.977Z] [INFO] Adding ignore: module-info
[2022-07-17T10:08:49.977Z] [INFO] Restricted to JDK 8 yet org.kohsuke.stapler:stapler:jar:1721.v6298feb_6eb_8f:compile contains org/kohsuke/stapler/framework/io/ByteBuffer$1.class targeted to JDK 11
[2022-07-17T10:08:49.977Z] [INFO] Restricted to JDK 8 yet org.kohsuke.stapler:stapler-groovy:jar:1721.v6298feb_6eb_8f:compile contains org/kohsuke/stapler/jelly/groovy/GroovyClassLoaderTearOff$1.class targeted to JDK 11
[2022-07-17T10:08:49.977Z] [INFO] Restricted to JDK 8 yet org.jenkins-ci:commons-jelly:jar:1.1-jenkins-20220630:compile contains org/apache/commons/jelly/util/TagUtils.class targeted to JDK 11
[2022-07-17T10:08:49.977Z] [INFO] Restricted to JDK 8 yet org.kohsuke.stapler:stapler-jelly:jar:1721.v6298feb_6eb_8f:compile contains org/kohsuke/stapler/jelly/package-info.class targeted to JDK 11
[2022-07-17T10:08:49.977Z] [ERROR] Rule 1: org.apache.maven.plugins.enforcer.EnforceBytecodeVersion failed with message:
[2022-07-17T10:08:49.977Z] Found Banned Dependency: org.kohsuke.stapler:stapler:jar:1721.v6298feb_6eb_8f
[2022-07-17T10:08:49.977Z] Found Banned Dependency: org.kohsuke.stapler:stapler-groovy:jar:1721.v6298feb_6eb_8f
[2022-07-17T10:08:49.977Z] Found Banned Dependency: org.jenkins-ci:commons-jelly:jar:1.1-jenkins-20220630
[2022-07-17T10:08:49.977Z] Found Banned Dependency: org.kohsuke.stapler:stapler-jelly:jar:1721.v6298feb_6eb_8f

basil · 2022-07-17T15:00:38Z

Looks like the default branch of Stapler with a bunch of unreleased commits (for incrementals) is incompatible with core. Nice.

@daniel-beck Why would it be “nice”? Your sarcasm is not appreciated. The corresponding changes have been ready for review in #6801 for 9 days.

core/src/main/java/hudson/Functions.java

war/src/main/webapp/scripts/hudson-behavior.js

github-actions · 2023-11-01T05:20:45Z

Please take a moment and address the merge conflicts of your pull request. Thanks!

github-actions · 2024-01-01T07:20:14Z

Please take a moment and address the merge conflicts of your pull request. Thanks!

daniel-beck · 2024-02-12T21:00:15Z

I plan to merge the upstream change and finalize the bom/pom.xml here shortly. Please review this PR if you're interested in it :)

timja · 2024-02-14T12:11:45Z

war/src/main/webapp/scripts/hudson-behavior.js

+  let proxyMethod = e.getAttribute("data-proxy-method");
+  let proxyUrl = e.getAttribute("data-proxy-url");
+  let proxyCrumb = e.getAttribute("data-proxy-crumb");
+  let proxyUrlNames = e.getAttribute("data-proxy-url-names").split(",");


shouldn't these be const?

Suggested change

let proxyMethod = e.getAttribute("data-proxy-method");

let proxyUrl = e.getAttribute("data-proxy-url");

let proxyCrumb = e.getAttribute("data-proxy-crumb");

let proxyUrlNames = e.getAttribute("data-proxy-url-names").split(",");

const proxyMethod = e.getAttribute("data-proxy-method");

const proxyUrl = e.getAttribute("data-proxy-url");

const proxyCrumb = e.getAttribute("data-proxy-crumb");

const proxyUrlNames = e.getAttribute("data-proxy-url-names").split(",");

jglick · 2024-02-14T12:17:43Z

test/src/test/java/org/kohsuke/stapler/BindTest.java

+
+        @Override
+        public String getUrlName() {
+            return "theWellKnownRoot";


Not a very realistic example of course, because it is a singleton (the point of WithWellKnownURL would be to look up a specific object based on parsing out a path), but good enough for purposes of tests here I suppose.

Given that this is the only implementation of WithWellKnownURL, we'll survive — if it weren't for your comments recently in the context of session serialization, I might have ripped it out entirely.

(Yes, there's another one in CloudBees, but it's long dead.)

timja · 2024-02-20T22:03:12Z

/label ready-for-merge

This PR is now ready for merge, after ~24 hours, we will merge it if there's no negative feedback.

Thanks!

[JENKINS-60866] Apply Stapler update for CSP-compliant st:bind

645beac

daniel-beck requested a review from Wadeck July 16, 2022 21:45

This comment was marked as outdated.

Sign in to view

daniel-beck added the work-in-progress The PR is under active development, not ready to the final review label Jul 16, 2022

[JENKINS-60866] Make renderOnDemand CSP-compliant

fbb392e

daniel-beck changed the title ~~[JENKINS-60866] Apply Stapler update for CSP-compliant st:bind~~ [JENKINS-60866] Apply Stapler update for CSP-compliant st:bind and renderOnDemand Jul 17, 2022

Thanks Spotless

9f675a4

Make Stapler incrementals work

60051b4

This was referenced Jul 18, 2022

[JENKINS-60866] Extract inline JS from progressive rendering #6860

Merged

[JENKINS-60866] Add initial guidelines how to make code compatible with CSP jenkins-infra/jenkins.io#5301

Merged

github-actions bot added the unresolved-merge-conflict There is a merge conflict with the target branch. label Aug 2, 2022

daniel-beck added 2 commits August 3, 2022 12:35

Update Stapler to new incremental

ffd7c36

Merge branch 'master' into csp-bind

2debadf

github-actions bot removed the unresolved-merge-conflict There is a merge conflict with the target branch. label Aug 3, 2022

github-actions bot added the unresolved-merge-conflict There is a merge conflict with the target branch. label Aug 10, 2022

Merge remote-tracking branch 'origin/master' into csp-bind

c2f5ae2

github-actions bot removed the unresolved-merge-conflict There is a merge conflict with the target branch. label Aug 26, 2022

basil added the squash-merge-me Unclean or useless commit history, should be merged only with squash-merge label Aug 26, 2022

github-actions bot added the unresolved-merge-conflict There is a merge conflict with the target branch. label Sep 7, 2022

daniel-beck changed the title ~~[JENKINS-60866] Apply Stapler update for CSP-compliant st:bind and renderOnDemand~~ [JENKINS-60866][JENKINS-71491] Apply Stapler update for CSP-compliant st:bind and renderOnDemand Aug 11, 2023

Merge remote-tracking branch 'jenkinsci/master' into csp-bind

269ac92

github-actions bot removed the unresolved-merge-conflict There is a merge conflict with the target branch. label Aug 11, 2023

Fixup bad merge

bd50766

daniel-beck marked this pull request as ready for review August 14, 2023 10:00

daniel-beck requested review from yaroslavafenkin and Kevin-CB August 14, 2023 10:00

daniel-beck added the needs-security-review Awaiting review by a security team member label Aug 14, 2023

jglick reviewed Aug 14, 2023

View reviewed changes

Merge branch 'master' into csp-bind

d2ab58d

github-actions bot added the unresolved-merge-conflict There is a merge conflict with the target branch. label Nov 1, 2023

Merge branch 'master' into csp-bind

844cac1

github-actions bot removed the unresolved-merge-conflict There is a merge conflict with the target branch. label Nov 1, 2023

github-actions bot added the unresolved-merge-conflict There is a merge conflict with the target branch. label Jan 1, 2024

daniel-beck added 3 commits February 12, 2024 20:58

Merge commit '09905a09d95026dcd20634ed48e810b209ce46da' into csp-bind

dfe2e0d

Merge remote-tracking branch 'origin/csp-bind' into csp-bind

afb4593

Merge remote-tracking branch 'jenkinsci/master' into csp-bind

a3b14ad

github-actions bot removed the unresolved-merge-conflict There is a merge conflict with the target branch. label Feb 12, 2024

daniel-beck mentioned this pull request Feb 12, 2024

[JENKINS-60866] Make st:bind tag and JavaScript proxy work without inline JS jenkinsci/stapler#385

Merged

daniel-beck marked this pull request as ready for review February 12, 2024 20:59

daniel-beck added the on-hold This pull request depends on another event/release, and it cannot be merged right now label Feb 12, 2024

Use released Stapler

dd8a075

daniel-beck removed the on-hold This pull request depends on another event/release, and it cannot be merged right now label Feb 14, 2024

daniel-beck mentioned this pull request Feb 14, 2024

stapler:bind is creating inline javascript jenkinsci/stapler#457

Closed

timja approved these changes Feb 14, 2024

View reviewed changes

jglick reviewed Feb 14, 2024

View reviewed changes

MarkEWaite added the skip-changelog Should not be shown in the changelog label Feb 14, 2024

daniel-beck added developer Changes which impact plugin developers and removed skip-changelog Should not be shown in the changelog labels Feb 14, 2024

MarkEWaite mentioned this pull request Feb 14, 2024

Bump stapler.version from 1822.v120278426e1c to 1839.ved17667b_a_eb_5 #8962

Closed

NotMyFault approved these changes Feb 20, 2024

View reviewed changes

timja removed the needs-more-reviews Complex change, which would benefit from more eyes label Feb 20, 2024

comment-ops-bot bot added the ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback label Feb 20, 2024

NotMyFault merged commit 6460778 into jenkinsci:master Feb 24, 2024
17 checks passed

timja mentioned this pull request Jul 18, 2024

Test history refactoring and improvements jenkinsci/junit-plugin#625

Merged

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[JENKINS-60866][JENKINS-71513] Apply Stapler update for CSP-compliant st:bind and renderOnDemand #6865

[JENKINS-60866][JENKINS-71513] Apply Stapler update for CSP-compliant st:bind and renderOnDemand #6865

daniel-beck commented Jul 16, 2022 •

edited

Loading

This comment was marked as outdated.

daniel-beck commented Jul 17, 2022 •

edited

Loading

basil commented Jul 17, 2022

github-actions bot commented Nov 1, 2023

github-actions bot commented Jan 1, 2024

daniel-beck commented Feb 12, 2024 •

edited

Loading

timja Feb 14, 2024

jglick Feb 14, 2024

daniel-beck Feb 14, 2024

timja commented Feb 20, 2024

[JENKINS-60866][JENKINS-71513] Apply Stapler update for CSP-compliant st:bind and renderOnDemand #6865

[JENKINS-60866][JENKINS-71513] Apply Stapler update for CSP-compliant st:bind and renderOnDemand #6865

Conversation

daniel-beck commented Jul 16, 2022 • edited Loading

Testing notes

Proposed changelog entries

Proposed upgrade guidelines

Submitter checklist

Desired reviewers

Maintainer checklist

This comment was marked as outdated.

daniel-beck commented Jul 17, 2022 • edited Loading

basil commented Jul 17, 2022

github-actions bot commented Nov 1, 2023

github-actions bot commented Jan 1, 2024

daniel-beck commented Feb 12, 2024 • edited Loading

timja Feb 14, 2024

Choose a reason for hiding this comment

jglick Feb 14, 2024

Choose a reason for hiding this comment

daniel-beck Feb 14, 2024

Choose a reason for hiding this comment

timja commented Feb 20, 2024

daniel-beck commented Jul 16, 2022 •

edited

Loading

daniel-beck commented Jul 17, 2022 •

edited

Loading

daniel-beck commented Feb 12, 2024 •

edited

Loading