version: RAP 4.5, client bundle served via tomcat.
My application uses JavaScriptExecutor for copy to clipboard integration, a cookie-consent banner, and chart interop. because of this i have to use unsafe-eval from the CSP.
JavaScriptExecutor.execute(String code) only accepts one fully formed script string, so any dynamic value has to be manually concatenated into it. example:
JavaScriptExecutor exe = RWT.getClient().getService(JavaScriptExecutor.class);
if (exe == null) return;
exe.execute(
"(function() {" +
" var policyUrl = window.location.origin + '/" + policySrc + "';" +
" var iframeSrc = window.location.origin + '/" + src + "?policy=' + encodeURIComponent(policyUrl);" +
" var iframe = document.createElement('iframe');" +
" iframe.src = iframeSrc;" +
" iframe.style.cssText = 'position:fixed;bottom:40px;right:24px;border:none;width:420px;height:245px;';" +
" document.body.appendChild(iframe);" +
"})();"
);none of the interpolated values in our application come directly from end-user input (they're widget IDs and server-side config), so these specific calls are not exploitable today. But the API design puts the escaping on the developer at every call, with no framework support to catch mistakes.
I would like to request a variant of the execute method if possible:
void execute(String script, Object... args);
in which the string could be some serialized format and the method itself could convert the parameters in args to a safer execute method so we would not have to remember to escape every string that can mix Java and JS.
note: i understand that a more parametrized method would reduce injection risk on the application but it would not remove the unsafe-eval in csp, due to how it would require a different dispatch method, which is a biger architectural change which might be worth tracking as a long term change. Also i would like to ask if there is some roadmap item to narrow the dependency on unsafe eval for these specific methods even if a full strict CSP without eval is not feaible.
version: RAP 4.5, client bundle served via tomcat.
My application uses JavaScriptExecutor for copy to clipboard integration, a cookie-consent banner, and chart interop. because of this i have to use
unsafe-evalfrom the CSP.JavaScriptExecutor.execute(String code)only accepts one fully formed script string, so any dynamic value has to be manually concatenated into it. example:none of the interpolated values in our application come directly from end-user input (they're widget IDs and server-side config), so these specific calls are not exploitable today. But the API design puts the escaping on the developer at every call, with no framework support to catch mistakes.
I would like to request a variant of the execute method if possible:
in which the string could be some serialized format and the method itself could convert the parameters in args to a safer execute method so we would not have to remember to escape every string that can mix Java and JS.
note: i understand that a more parametrized method would reduce injection risk on the application but it would not remove the unsafe-eval in csp, due to how it would require a different dispatch method, which is a biger architectural change which might be worth tracking as a long term change. Also i would like to ask if there is some roadmap item to narrow the dependency on unsafe eval for these specific methods even if a full strict CSP without eval is not feaible.