-
Type:
Bug
-
Status: Resolved
-
Priority:
Major
-
Resolution: Won't Fix
-
Affects Version/s: 3.0.2
-
Fix Version/s: None
-
Component/s: Filters
-
Tags:
-
Backlog priority:850
-
Sprint:UI - 2023-12, UI - 2024-02, UI COOLDOWN - 2023-12
-
Story Points:5
If using a stricter CSP (removing unsafe-eval and unsafe-inline), org.nuxeo.web.ui.expressions.eval must be set to false. However, doing so causes the usage of the arrow function '=>' in nuxeo-filter expressions to trigger a SyntaxError in the console and fail the condition check.
Steps to Reproduce:
1. Set the following CSP override (via XML extension or configuration template):
<require>org.nuxeo.ecm.platform.web.common.requestcontroller.service.RequestControllerService.defaultContrib</require> <extension target="org.nuxeo.ecm.platform.web.common.requestcontroller.service.RequestControllerService" point="responseHeaders"> <header name="Content-Security-Policy">default-src 'self'; script-src 'self' data: *; style-src 'self' 'unsafe-inline'; img-src 'self' data: www.nuxeo.com; font-src * data:; media-src 'self'; frame-src 'self'; frame-ancestors 'self'; object-src 'none';</header> </extension> <extension target="org.nuxeo.runtime.ConfigurationService" point="configuration"> <property name="org.nuxeo.web.ui.expressions.eval">false</property> </extension>
2. Configure a slot contribution (in the custom bundle .HTML file) including a filter that has an expression using the JS arrow function. For example, the following displays the Permissions tab if the Document has "Folderish" in its facets:
<nuxeo-slot-content name="documentPermissionsItem" slot="DOCUMENT_VIEWS_ITEMS" order="20"> <template> <nuxeo-filter document="[[document]]" expression="document.facets.some(f => f === 'Folderish')"> <template> <nuxeo-page-item name="permissions" label="browser.permissions"></nuxeo-page-item> </template> </nuxeo-filter> </template> </nuxeo-slot-content>
3. Log in to Web UI and navigate to a Document (attempting to interpret the expression used in the nuxeo-filter element).
Expected behavior: the expression is correctly interpreted and evaluates.
Actual behavior: The following error is seen in the browser console:
main.bundle.js:4493 SyntaxError: Unexpected token (1:47) in <nuxeo-filter> expression "!document.isVersion && document.facets.some(f => f !== 'Folderish')"
- is related to
-
-
- In Progress
-
