Browse Source

[security] Add Job Browser back for unsafe inline (#4078)

we had blacklist job browser initially, Now i have tested it, it is working as expected. we have added all nonce_attributes to the jobs pages already.

---------

Co-authored-by: Mohammed Tabraiz <tabraiz@cloudera.com>
Tabraiz 8 tháng trước cách đây
mục cha
commit
96ffaad8b7

+ 1 - 1
desktop/core/src/desktop/appmanager.py

@@ -264,7 +264,7 @@ def load_apps(app_blacklist):
 
 
     if desktop.conf.CSP_NONCE.get():
     if desktop.conf.CSP_NONCE.get():
       # This Apps are not supported CSP Nonce is enabled.
       # This Apps are not supported CSP Nonce is enabled.
-      app_blacklist.extend(['oozie', 'jobbrowser', 'rdbms', 'search', 'zookeeper'])
+      app_blacklist.extend(['oozie', 'rdbms', 'search', 'zookeeper'])
     if sdk_app.name not in app_blacklist:
     if sdk_app.name not in app_blacklist:
       # TODO: Remove once pig and jobsub have been migrated to editor
       # TODO: Remove once pig and jobsub have been migrated to editor
       if 'oozie' in app_blacklist and sdk_app.name in ('pig', 'jobsub'):
       if 'oozie' in app_blacklist and sdk_app.name in ('pig', 'jobsub'):

+ 1 - 1
desktop/core/src/desktop/js/onePageViewModel.js

@@ -461,7 +461,7 @@ class OnePageViewModel {
               self.extraEmbeddableURLParams('');
               self.extraEmbeddableURLParams('');
               const currentPath = window.location.pathname; // Retrieve the current path from the window location
               const currentPath = window.location.pathname; // Retrieve the current path from the window location
               const basePath = currentPath.split('=')[0];
               const basePath = currentPath.split('=')[0];
-              const inlineScriptsUrls = ['oozie', 'beeswax', 'jobbrowser', 'jobsub'].some(segment =>
+              const inlineScriptsUrls = ['oozie', 'beeswax', 'jobsub'].some(segment =>
                 basePath.includes(segment)
                 basePath.includes(segment)
               );
               );
               if (inlineScriptsUrls) {
               if (inlineScriptsUrls) {