Move all inline code to .js files

[rhansen]

I would like to move all of the inline code into .js files so that users can set a Content Security Policy (CSP) that prohibits inline code. Prohibiting inline code reduces the potential number of XSS vulnerabilities.

[rhansen]

As a first step, I would like to delete the indexCustomInlineScripts hook that was added in PR #3996 for issue #3978.

cc @brunob

[JohnMcLear]

Makes sense to me. I used ep_helmet to handle CSP by adding nonces btw but moving it out from being inline is way better. Peep ep_helmet first and the nonce open PR as reference points 👍

[brunob]

Why not, but what alternative would we have to modify the index inline script after that ?

[JohnMcLear]

@brunob isn't there a hook to include JavaScript in the head?

[brunob]

@JohnMcLear i don't think so, here is what we do with that hook https://framagit.org/infini/ep_infini/-/blob/master/infini.js#L10

[JohnMcLear]

Okay so @rhansen why remove it? Just ensure the docs say to people to only reference scripts here IE how the template does it..

<script src="static/skins/<%=encodeURI(settings.skinName)%>/index.js?v=<%=settings.randomVersionString%>"></script>

An example of how not to do it could be

function(){alert("pow")};

An example of how to do it could be..

<script src="myawesomepluginscript.js"></script>

We could also just in the HTML put a comment saying not to include inline JS...

I'm lazy too which is why I prefer nonce approach over removing inline completely because this catches all potential plugin issues...

[rhansen]

I moved the indexCustomInlineScripts-specific discussion to PR #4402.

I prefer nonce approach over removing inline completely because this catches all potential plugin issues...

Adding a nonce might be a good temporary fix, but I don't like it as a long-term fix because:

• It is easy to do it incorrectly (insecurely).
• It breaks caching. (By definition, a nonce value can only be used once.)
• We would have to set the CSP header in Etherpad itself rather than let users set the CSP header in their reverse proxy. (Only Etherpad knows the nonce value.)
• We should migrate away from inline JavaScript anyway because it's harder to maintain.