fix: address CSP guidelines in JENKINS-74474 and JENKINS-74475

plugin.nix

@@ -2,7 +2,7 @@
 
 maven.buildMavenPackage {
   pname = "sysdig-secure-plugin";
-  version = "3.0.2";
+  version = "3.0.3";
   src = ./.;
   mvnHash = "sha256-BXnqTBE27wVP8JpWT6ed597CORhiHw6Ogc2tY6rNCIU=";
 

src/main/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/vm/ui/SysdigAction/index-script.js

@@ -0,0 +1,22 @@
+document.addEventListener('DOMContentLoaded', function () {
+    const dataHolderDiv = document.getElementById('index-data-holder');
+    if (!dataHolderDiv) {
+      return;
+    }
+
+    const dataGatesSummaryTable = dataHolderDiv.getAttribute('data-gates-summary-table');
+    const dataGatesTable = dataHolderDiv.getAttribute('data-gates-table');
+    const dataSecurityTable = dataHolderDiv.getAttribute('data-security-table');
+
+    if (dataGatesSummaryTable != '') {
+      buildPolicyEvalSummaryTable("#gates_summary_table", dataGatesSummaryTable);
+    }
+
+    if (dataGatesTable != '') {
+      buildPolicyEvalTable("#gates_table", dataGatesTable);
+    }
+
+    if (dataSecurityTable != '') {
+      buildSecurityTable("#security_table", dataSecurityTable);
+    }
+});

src/main/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/vm/ui/SysdigAction/index.jelly

@@ -32,17 +32,11 @@
                                                class="table table-striped table-bordered dataTable no-footer"
                                                style="width: 100%;"></table>
                                     </div>
-                                    <script type="text/javascript">
-                                        buildPolicyEvalSummaryTable("#gates_summary_table", ${it.gateSummary});
-                                    </script>
                                 </j:if>
 
                                 <h3 class="title">Sysdig Secure Policy Evaluation Report</h3>
                                 <table id="gates_table" class="table table-striped table-bordered dataTable no-footer"
                                        style="width: 100%;"></table>
-                                <script type="text/javascript">
-                                    buildPolicyEvalTable("#gates_table", "${it.gateOutputUrl}");
-                                </script>
                             </div>
 
                             <j:if test="${!empty(it.cveListingUrl)}">
@@ -106,10 +100,18 @@
                                         <table id="security_table" class="table table-striped table-bordered dataTable "
                                                style="width: 100%;"></table>
                                     </div>
-                                    <script type="text/javascript">
-                                        buildSecurityTable("#security_table", "${it.cveListingUrl}");
-                                    </script>
                                 </div>
+
+                                <!--
+                                    In order to prevent XSS, we need to hold the data in an HTML element called 'data-holder' and adjunct the script,
+                                    that will retrieve the contents of the div, and execute the script on DOMContentLoaded
+                                 -->
+                                <div id="index-data-holder"
+                                     data-gates-summary-table="${it.gateSummary}"
+                                     data-gates-table="${it.gateOutputUrl}"
+                                     data-security-table="${it.cveListingUrl}"
+                                />
+                                <st:adjunct includes="com.sysdig.jenkins.plugins.sysdig.infrastructure.jenkins.vm.ui.SysdigAction.index-script" />
                             </j:if>
                         </div>
                     </div>
@@ -126,7 +128,6 @@
                         <br></br>
                     </j:forEach>
                 </j:otherwise>
-
             </j:choose>
         </l:main-panel>
     </l:layout>

src/main/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/vm/ui/SysdigAction/new-engine-summary.js

@@ -0,0 +1,11 @@
+document.addEventListener('DOMContentLoaded', function () {
+    const summaryDiv = document.getElementById('result-summary-data-holder');
+    if (!summaryDiv) {
+    return;
+    }
+
+    const cveListingUrl = summaryDiv.getAttribute('data-cve-listing-url');
+    const gateOutputUrl = summaryDiv.getAttribute('data-gate-output-url');
+
+    getSummaryRecap('#result-summary', cveListingUrl, gateOutputUrl);
+});

src/main/resources/com/sysdig/jenkins/plugins/sysdig/infrastructure/jenkins/vm/ui/SysdigAction/newEngineSummary.jelly

@@ -2,8 +2,15 @@
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout"
          xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <st:include page="scripts.jelly" it="${it}"/>
-    <script type="text/javascript">
-        getSummaryRecap('#result-summary', '${it.cveListingUrl}', '${it.gateOutputUrl}');
-    </script>
+
+    <!--
+        In order to prevent XSS, we need to hold the data in an HTML element called 'data-holder' and adjunct the script,
+        that will retrieve the contents of the div, and execute the script on DOMContentLoaded
+     -->
+    <div id="result-summary-data-holder"
+         data-cve-listing-url="${it.cveListingUrl}"
+         data-gate-output-url="${it.gateOutputUrl}">
+    </div>
+    <st:adjunct includes="com.sysdig.jenkins.plugins.sysdig.infrastructure.jenkins.vm.ui.SysdigAction.new-engine-summary" />
     <div id="result-summary"/>
 </j:jelly>