github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

Identify CSP test functions (#184456)

Browse source
This commit is contained in:
Larry Gregory 2024-05-30 06:04:55 -04:00 • committed by GitHub
parent 71ea578bcb
commit 3e44cca7e7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
packages/core/rendering/core-rendering-server-internal/src/views/template.tsx
View file

@ -110,7 +110,8 @@ export const Template: FunctionComponent<Props> = ({
</div>
<script>
{`
{`// kbnUnsafeInlineTest do not remove this comment:
// it is used for filtering out expected CSP failures, and must be the first piece of content in this script block.
// Since this is an unsafe inline script, this code will not run
// in browsers that support content security policy(CSP). This is
// intentional as we check for the existence of __kbnCspNotEnforced__ in

4
packages/kbn-handlebars/src/utils.ts
View file

@ -61,7 +61,9 @@ export function transformLiteralToPath(node: { path: hbs.AST.PathExpression | hb
export function allowUnsafeEval() {
try {
new Function();
// Do not remove the `kbnUnsafeEvalTest` parameter.
// It is used for filtering out expected CSP failures, and must be the first piece of content in this function.
new Function('kbnUnsafeEvalTest', 'return true;');
return true;
} catch (e) {
return false;