803178 - FIX CSP Violations (remove inline js)

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Calendar, defect, P2)

Description

[James Lal [:lightsofapollo]]

We have a few places where we use inline scripts (including app start up) we need to remove these.

Comment 2

[Schalk Neethling [:espressive]]

I guess you are referring to items such as this:
<a href="javascript: window.history.go(-1);">

Comment 3

[Alexandre Poirot [:ochameau]]

Attachment: Pull request 5987 - remove inline scripts

Comment 4

[Alexandre Poirot [:ochameau]]

Attachment: Pull request 5986 - remove eval usage

Another patch to fix template.js usage of Function() which is equivalent to eval() and is forbidden regarding CSP rules.
I tried to implement an efficient equivalent implementation but didn't had enough lifetime on calendar to notice better or slower performances.

Comment 5

[Alexandre Poirot [:ochameau]]

Landed:
https://github.com/mozilla-b2g/gaia/commit/4b999a7866c01a61642fa2015df0868d6eb68c88

Comment 6

[Alexandre Poirot [:ochameau]]

Actually there is still PR 5987 to land.

Comment 7

[James Lal [:lightsofapollo]]

I believe with PR 5987 we have fixed the CSP issues. Nice work Alexandre.