[
https://issues.apache.org/jira/browse/SOLR-13987?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16989355#comment-16989355
]
Kevin Risden commented on SOLR-13987:
-------------------------------------
So I think the fix for Angular is as follows based on the reference
https://code.angularjs.org/1.3.8/docs/api/ng/directive/ngCsp Robert shared and
some more research.
* <html ng-app="solrAdminApp" ng-csp>
**
https://github.com/apache/lucene-solr/blob/master/solr/webapp/web/index.html#L2
* <link rel="stylesheet" type="text/css"
href="css/angular/angular-csp.css?_=${version}">
**
https://github.com/apache/lucene-solr/blob/master/solr/webapp/web/index.html#L26
** Need to add https://code.angularjs.org/1.3.8/angular-csp.css to
solr/webapp/web/css/angular
** Angular 1.3.8 from
https://github.com/apache/lucene-solr/blob/master/solr/webapp/web/libs/angular.min.js#L25
* Remove 'unsafe-eval' and 'unsafe-inline' from solr/server/etc/jetty.xml
I can try this over the next few days.
> fix admin UI to not rely on javascript eval()
> ---------------------------------------------
>
> Key: SOLR-13987
> URL: https://issues.apache.org/jira/browse/SOLR-13987
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Reporter: Robert Muir
> Priority: Major
>
> Followup from SOLR-13982: currently any CSP is weak because it must allow
> this eval: means arbitrary javascript can still be executed.
> Let's fix the admin UI to not require eval so it can be disabled by the
> browser.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
