Backport of CSP-related changes

[jasondlee]

Backporting CSP-related changes from 5.x to the 4.0 branch.

[jasondlee]

@arjantijms @BalusC Any thoughts on this?

[softwaresicario]

Thanks for backporting this, first off!

Secondly, out of all the changes implemented, I can't seem to find the one addressing the need of unsafe-eval because of the use of faces.util.chain(this,event,'mojarra.ab(....

Any chance of any of the PR participants to point it out?

Thanks in advance for your time!

[BalusC]

LGTM :) But why exactly is Issue5576IT disabled?

Have you already ran the entire 4.0 TCK on this branch? Did it all pass?

(sorry for late response, I was vacationing)

[jasondlee]

Thanks for backporting this, first off!

Secondly, out of all the changes implemented, I can't seem to find the one addressing the need of unsafe-eval because of the use of faces.util.chain(this,event,'mojarra.ab(....

@fcarriedos Sorry. Work took me away from this for a bit. :) I thought I had ported everything. Can you point to what I missed? Definitely want to make sure we get it all. :)

[softwaresicario]

@jasondlee Thanks for coming back to me on this one!

I'm failing to see any specific change to address the issue described below, more specifically in the definition of faces.util.chain in faces.js to solve the issue described below.

Please let me know if I missed something, I am looking in the wrong place or any clarification is needed.

Context

When there is more than one event handler or more than one action per handler, faces.js chains invocations by creating new Function objects and invoking them, see:

mojarra/impl/src/main/resources/META-INF/resources/jakarta.faces/faces-uncompressed.js

Line 3527 in 1ae407c

var f = new Function("event", arguments[i]);

For this to work, the Content Security Policy forces the need for unsafe-eval (insecure and an obstacle to comply with a solid CSP). Otherwise the execution fails as shown in the screenshots.

I pushed this reproducer and I'm attaching some screenshots that hopefully help clarifying the issue.

Thanks in advance for your time! 🙇

[jasondlee]

@fcarriedos Thanks. I'll give that a look. My backport is, fwiw, a backport of all of the CSP-related changes from 5.x. I don't pretend to understand all of the changes, but I'll try to fix that. :)

[BalusC]

I fixed it in 5.0 #5631

@jasondlee you can now backport thas as well into your branch

[jasondlee]

I fixed it in 5.0 #5631

@jasondlee you can now backport thas as well into your branch

Thanks! On it...