remove inline javascript

remove the inline javascript from the redirect page and the index of the action. use relative urls in the redirect instead of absoluturl which is considered dangerous (this probably fixes JENKINS-64825)
jenkinsci · Feb 5, 2024 · d18e6b2 · d18e6b2
1 parent 4c3a721
commit d18e6b2
Show file tree

Hide file tree

Showing 5 changed files with 28 additions and 59 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/schedulebuild/ScheduleBuildAction.java b/src/main/java/org/jenkinsci/plugins/schedulebuild/ScheduleBuildAction.java
@@ -116,7 +116,7 @@ public Date getDefaultDateObject() {
     }
 
     @RequirePOST
-    public FormValidation doCheckDate(@QueryParameter String date, @AncestorInPath Item item) {
+    public FormValidation doCheckDate(@QueryParameter String value, @AncestorInPath Item item) {
         if (item == null) {
             return FormValidation.ok();
         }
@@ -125,7 +125,7 @@ public FormValidation doCheckDate(@QueryParameter String date, @AncestorInPath I
         Date ddate, now = new Date();
         DateFormat dateFormat = dateFormat();
         try {
-            ddate = dateFormat.parse(date);
+            ddate = dateFormat.parse(value);
             now = dateFormat.parse(dateFormat.format(now));
         } catch (ParseException ex) {
             return FormValidation.error(Messages.ScheduleBuildAction_ParsingError());

diff --git a/src/main/resources/org/jenkinsci/plugins/schedulebuild/ScheduleBuildAction/index.jelly b/src/main/resources/org/jenkinsci/plugins/schedulebuild/ScheduleBuildAction/index.jelly
@@ -6,12 +6,13 @@
             <h1>${%Project} ${it.owner.name}</h1>
             <f:form name="schedule" action="next" method="post">
                 <f:entry title="${%BuildOn} (mm/dd/yy):" field="date">
-                    <f:textbox value="${it.defaultDate}" checkUrl="'${rootURL}/${it.owner.url}schedule/checkDate?date=' + encodeURIComponent(this.value)" onKeyUp="this.onchange();"/>
+                    <f:textbox id="schedule-build-input" value="${it.defaultDate}" checkUrl="${rootURL}/${it.owner.url}schedule/checkDate" checkDependsOn=""/>
                 </f:entry>
                 <f:entry>
-                    <f:submit value="${%Schedule}"/>
+                    <f:submit value="${%Schedule}" id="schedule-build-button"/>
                 </f:entry>
             </f:form>
+            <script src="${rootURL}/plugin/schedule-build/scheduleBuild.js"/>
         </l:main-panel>
     </l:layout>
 </j:jelly>
diff --git a/src/main/resources/org/jenkinsci/plugins/schedulebuild/ScheduleBuildAction/redirect.jelly b/src/main/resources/org/jenkinsci/plugins/schedulebuild/ScheduleBuildAction/redirect.jelly
@@ -5,13 +5,12 @@
       <!--
         Auto submits the form to the jenkins server
       -->
-      <p>
-        Submitting your changes to the server...
+      <p id="schedule-build-data" data-url="${rootURL}/${it.owner.url}"
+         data-quiet-period-seconds="${it.quietPeriodInSeconds}"
+         data-parameterized="${it.owner.parameterized}">
+        <l:spinner text="Submitting your changes to the server..." />
       </p>
-       <script src="${rootURL}/plugin/schedule-build/scheduleRequest.js"/>
-      <script>
-      	sumbitScheduleRequest("${it.owner.absoluteUrl}", ${it.quietPeriodInSeconds}, ${it.jobParameterized});
-      </script>
+      <script src="${rootURL}/plugin/schedule-build/scheduleRequest.js"/>
     </l:main-panel>
   </l:layout>
 </j:jelly>
diff --git a/src/main/webapp/scheduleBuild.js b/src/main/webapp/scheduleBuild.js
@@ -0,0 +1,5 @@
+Behaviour.specify("#schedule-build-input", "schedule-build-input", 0, function(input) {
+  input.onkeyup = function(event) {
+    input.onchange();
+  }
+});
diff --git a/src/main/webapp/scheduleRequest.js b/src/main/webapp/scheduleRequest.js
@@ -1,50 +1,14 @@
-var newRequest = function() {
-	if (window.XMLHttpRequest) {
-		return new XMLHttpRequest();
-	} else {
-		return new ActiveXObject("Microsoft.XMLHTTP");
-	}
-}
-
-var sumbitScheduleRequest = function(absoluteUrl, quietPeriodInSeconds, isJobParameterized){
-
-	if(isJobParameterized){
-		// if job has parameters, redirect to build page, so user can set parameters
-		window.location = absoluteUrl + "build?delay=" + quietPeriodInSeconds + "sec";
-	}else{
-		// if job has NO parameters, submit build directly
-		var csrfCrumb;
-		var csrfRequest = newRequest();
-		csrfRequest.onreadystatechange = function() {
-			if (csrfRequest.readyState === 4) {
-				if (csrfRequest.status === 200 || csrfRequest.status === 201) {
-					csrfCrumb = JSON.parse(csrfRequest.responseText);
-				} else {
-					// csrf might be deactivated
-				}
-
-				// do the actual submit
-				var xmlhttp = newRequest();
-				xmlhttp.onreadystatechange = function() {
-					if (xmlhttp.readyState === 4) {
-						if (xmlhttp.status === 200 || xmlhttp.status === 201) {
-							window.location = absoluteUrl;
-							return false;
-						} else {
-							window.location = absoluteUrl;
-							return false;
-						}
-					}
-				};
-				xmlhttp.open("POST", absoluteUrl + "build?delay=" + quietPeriodInSeconds + "sec", true);
-				if (csrfCrumb) {
-					xmlhttp.setRequestHeader(csrfCrumb.crumbRequestField, csrfCrumb.crumb)
-				}
-				xmlhttp.send();
-			}
-		};
-
-		csrfRequest.open('GET', rootURL + '/crumbIssuer/api/json', false);
-		csrfRequest.send();
-	}
+let d = document.getElementById("schedule-build-data");
+let url = d.dataset.url;
+let quietPeriodInSeconds = d.dataset.quietPeriodSeconds;
+let scheduleUrl = url + "build?delay=" + quietPeriodInSeconds + "sec";
+
+if (d.dataset.parameterized === "true") {
+  window.location = d.dataset.url + "build?delay=" + quietPeriodInSeconds + "sec";
+} else {
+  fetch(scheduleUrl, {
+    method: "post",
+    headers: crumb.wrap({}),
+  });
+  window.location = url;
 }