From 093b03e8ab5a4c8d9ad4499ce72d55e845353aa3 Mon Sep 17 00:00:00 2001
From: alokhyland <Alok.Ranjan@Hyland.com>
Date: Wed, 11 Sep 2024 10:10:42 +0530
Subject: [PATCH] WEBUI-1579,1282,1575,1580 : csp changes

---
 addons/nuxeo-csv/elements/nuxeo-document-import-csv.js |  5 +++--
 .../elements/nuxeo-liveconnect-box-link.js             |  5 +++--
 .../elements/nuxeo-liveconnect-google-drive-link.js    |  5 +++--
 addons/nuxeo-spreadsheet/webpack.config.js             |  5 +++++
 elements/nuxeo-selection/nuxeo-selection-toolbar.js    | 10 ++++++----
 elements/workflow/nuxeo-document-task.js               |  5 +++--
 package.json                                           |  1 +
 .../src/main/resources/web/nuxeo.war/ui/index.jsp      | 10 +++++-----
 8 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/addons/nuxeo-csv/elements/nuxeo-document-import-csv.js b/addons/nuxeo-csv/elements/nuxeo-document-import-csv.js
index beb8e5ae1d..67d312373a 100644
--- a/addons/nuxeo-csv/elements/nuxeo-document-import-csv.js
+++ b/addons/nuxeo-csv/elements/nuxeo-document-import-csv.js
@@ -276,7 +276,7 @@ Polymer({
           <template is="dom-if" if="[[!hasFile]]">
             <div class="vertical layout center center-justified flex">
               <div class="dropzone-label horizontal layout center center-justified">
-                <a href="javascript:undefined" on-tap="_showUploadDialog"> [[i18n('csv.import.clickOrDrop')]]</a>
+                <a href="#" on-tap="_showUploadDialog"> [[i18n('csv.import.clickOrDrop')]]</a>
               </div>
             </div>
           </template>
@@ -581,7 +581,8 @@ Polymer({
     }
   },
 
-  _showUploadDialog() {
+  _showUploadDialog(e) {
+    e.preventDefault();
     this.$.uploadFiles.click();
   },
 
diff --git a/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-box-link.js b/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-box-link.js
index 8802d63579..19ed50997c 100644
--- a/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-box-link.js
+++ b/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-box-link.js
@@ -64,7 +64,7 @@ Polymer({
       is-available="{{isProviderAvailable}}"
     ></nuxeo-liveconnect-box-provider>
     <template is="dom-if" if="[[isProviderAvailable]]">
-      <a href="javascript:undefined" on-tap="_openPicker">
+      <a href="#" on-tap="_openPicker">
         <iron-icon src="[[importPath]]images/box.png"></iron-icon>
         [[i18n('liveconnectImportActions.box', 'Box')]]
       </a>
@@ -78,7 +78,8 @@ Polymer({
     this.$.provider.updateProviderInfo();
   },
 
-  _openPicker() {
+  _openPicker(e) {
+    e.preventDefault();
     this.$.provider.openPicker();
   },
 });
diff --git a/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-google-drive-link.js b/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-google-drive-link.js
index efbc2d8b24..5f342a0c9b 100644
--- a/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-google-drive-link.js
+++ b/addons/nuxeo-liveconnect/elements/nuxeo-liveconnect-google-drive-link.js
@@ -64,7 +64,7 @@ Polymer({
       is-available="{{isProviderAvailable}}"
     ></nuxeo-liveconnect-google-drive-provider>
     <template is="dom-if" if="[[isProviderAvailable]]">
-      <a href="javascript:undefined" on-tap="_openPicker">
+      <a href="#" on-tap="_openPicker">
         <iron-icon src="[[importPath]]images/google_drive.png"></iron-icon>
         [[i18n('liveconnectImportActions.googledrive', 'Google Drive')]]
       </a>
@@ -78,7 +78,8 @@ Polymer({
     this.$.provider.updateProviderInfo();
   },
 
-  _openPicker() {
+  _openPicker(e) {
+    e.preventDefault();
     this.$.provider.openPicker();
   },
 });
diff --git a/addons/nuxeo-spreadsheet/webpack.config.js b/addons/nuxeo-spreadsheet/webpack.config.js
index e9ec5aad6a..b12b542a71 100644
--- a/addons/nuxeo-spreadsheet/webpack.config.js
+++ b/addons/nuxeo-spreadsheet/webpack.config.js
@@ -1,6 +1,7 @@
 const { resolve } = require('path');
 const { ProvidePlugin } = require('webpack');
 const HtmlWebpackPlugin = require('html-webpack-plugin');
+const htmlWebpackInjectAttributesPlugin = require('html-webpack-inject-attributes-plugin');
 
 module.exports = {
   entry: {
@@ -16,5 +17,9 @@ module.exports = {
       chunks: ['spreadsheet.app'],
       template: resolve(__dirname, 'app', 'index.html'),
     }),
+    /* eslint-disable-next-line new-cap */
+    new htmlWebpackInjectAttributesPlugin({
+      nonce: 'dummy',
+    }),
   ],
 };
diff --git a/elements/nuxeo-selection/nuxeo-selection-toolbar.js b/elements/nuxeo-selection/nuxeo-selection-toolbar.js
index f941faeecc..c686f2b58a 100644
--- a/elements/nuxeo-selection/nuxeo-selection-toolbar.js
+++ b/elements/nuxeo-selection/nuxeo-selection-toolbar.js
@@ -112,7 +112,7 @@ Polymer({
             <span class="count" aria-live="polite">
               [[i18n('selectionToolbar.selected.items', selectedItems.length)]]
             </span>
-            <a class="selectionLink" on-tap="toogleSelectedItemsPopup" href="javascript:void(0)">
+            <a class="selectionLink" on-tap="toogleSelectedItemsPopup" href="#">
               <span>[[i18n('selectionToolbar.display.selection')]]</span>
             </a>
           </template>
@@ -121,7 +121,7 @@ Polymer({
           <template is="dom-if" if="[[selectAllActive]]">
             <span class="count" aria-live="polite">[[i18n('selectionToolbar.selected.all', _resultsCount)]]</span>
           </template>
-          <a class="selectionLink" on-tap="clearSelection" href="javascript:void(0)">
+          <a class="selectionLink" on-tap="clearSelection" href="#">
             <span>[[i18n('command.clear')]]</span>
           </a>
         </div>
@@ -188,11 +188,13 @@ Polymer({
     this.hidden = !this.selectedItems || this.selectedItems.length === 0;
   },
 
-  toogleSelectedItemsPopup() {
+  toogleSelectedItemsPopup(e) {
+    e.preventDefault();
     this.$$('#selectedItemsPopup').toggle();
   },
 
-  clearSelection() {
+  clearSelection(e) {
+    e.preventDefault();
     this.fire('clear-selected-items');
   },
 });
diff --git a/elements/workflow/nuxeo-document-task.js b/elements/workflow/nuxeo-document-task.js
index 139fe72f40..28a6e35a20 100644
--- a/elements/workflow/nuxeo-document-task.js
+++ b/elements/workflow/nuxeo-document-task.js
@@ -158,7 +158,7 @@ Polymer({
               </div>
             </template>
           </div>
-          <a href="javascript:undefined" on-tap="_toggleGraphDialog" class="view-graph">[[i18n('tasks.viewGraph')]]</a>
+          <a href="#" on-tap="_toggleGraphDialog" class="view-graph">[[i18n('tasks.viewGraph')]]</a>
           <div class="horizontal spaced">
             <span>[[i18n(tasks.directive)]]</span>
           </div>
@@ -314,7 +314,8 @@ Polymer({
       .finally(() => this._setProcessing(false));
   },
 
-  _toggleGraphDialog() {
+  _toggleGraphDialog(e) {
+    e.preventDefault();
     this.$.graph.show();
   },
 
diff --git a/package.json b/package.json
index ef94f66456..fe87c09f8c 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "expose-loader": "^1.0.1",
     "glob": "^7.1.3",
     "html-loader": "^1.3.2",
+    "html-webpack-inject-attributes-plugin": "^1.0.6",
     "html-webpack-plugin": "^5.6.0",
     "http-server": "^0.11.1",
     "husky": "^4.2.3",
diff --git a/plugin/web-ui/addon/src/main/resources/web/nuxeo.war/ui/index.jsp b/plugin/web-ui/addon/src/main/resources/web/nuxeo.war/ui/index.jsp
index c23574fec6..718c2f0751 100644
--- a/plugin/web-ui/addon/src/main/resources/web/nuxeo.war/ui/index.jsp
+++ b/plugin/web-ui/addon/src/main/resources/web/nuxeo.war/ui/index.jsp
@@ -98,15 +98,15 @@ limitations under the License.
     </div>
   </nuxeo-app>
 
-  <script src="vendor/webcomponentsjs/webcomponents-loader.js"></script>
+  <script src="vendor/webcomponentsjs/webcomponents-loader.js" nonce="dummy"></script>
 
-  <script src="vendor/html-imports/html-imports.min.js"></script>
+  <script src="vendor/html-imports/html-imports.min.js" nonce="dummy"></script>
 
-  <script src="vendor/web-animations/web-animations-next-lite.min.js"></script>
+  <script src="vendor/web-animations/web-animations-next-lite.min.js" nonce="dummy"></script>
 
-  <script src="config.jsp"></script>
+  <script src="config.jsp" nonce="dummy"></script>
 
-  <script src="main.bundle.js"></script>
+  <script src="main.bundle.js" nonce="dummy"></script>
 
 </body>