First step for jakartaee/faces#1590 #5601
Conversation
inline event handlers to attached event handlers so they are at least CSP compatible
is rendered AFTER the end element is rendered; adjusted addEventListener to be executed as eval instead of unupdateable script element; improved faces.js to reuse nonce from faces.js itself, if any
is rendered AFTER the end element is rendered
written as previously done
|
Entire 5.0 TCK passed, with only one adjusted test, so undrafting PR. |
|
What are the chances of backporting this behavior to 4.x? It seems like the spec changes are just to codify support for a CSP, right? Can we (and by that I probably mean me ;) backport these changes to the 4.x branches? |
|
TCK would need update as well because Issue2439IT would fail on this change (fixed for TCK 5.0 here: jakartaee/faces#2055 ) @arjantijms would it be possible to fix this as well in the TCK for 4.1 or perhaps even 4.0 so we can backport this? |
BalusC
deleted the
faces_issue_1590_convert_all_inline_event_handlers_to_attached_event_handlers
branch
FWIW, I was feeling ambitious last night, so I attempted to backport the changes. Short of one broken integration test, which may very well be environmental, I think they all applied fairly cleanly, if requiring fair bit of manual work. You can see the PR here: #5606 |
First step for jakartaee/faces#1590: convert all Mojarra-generated inline event handlers to attached event handlers so they are at least CSP compatible