kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Add nonce to eval in shortcuts.js

Browse source 
Prevents the eval script being blocked when
we have CSP rules to disable inline scripts
This commit is contained in:
Heinrich Lee Yu 2019-08-15 14:10:24 +08:00
parent ee9f0bb7a5
commit dd9e88eddb
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/assets/javascripts/behaviors/shortcuts/shortcuts.js
View file

@ -4,7 +4,7 @@ import Mousetrap from 'mousetrap';
import axios from '../../lib/utils/axios_utils';
import { refreshCurrentPage, visitUrl } from '../../lib/utils/url_utility';
import findAndFollowLink from '../../lib/utils/navigation_utility';
import { parseBoolean } from '~/lib/utils/common_utils';
import { parseBoolean, getCspNonceValue } from '~/lib/utils/common_utils';
const defaultStopCallback = Mousetrap.stopCallback;
Mousetrap.stopCallback = (e, element, combo) => {
@ -94,7 +94,7 @@ export default class Shortcuts {
responseType: 'text',
})
.then(({ data }) => {
$.globalEval(data);
$.globalEval(data, { nonce: getCspNonceValue() });
if (location && location.length > 0) {
const results = [];