Skip to content

fix(ui): use delegated event handlers for search and password inputs to comply with CSP (#7283) - #7336

Open
chiragjangiir wants to merge 1 commit into
IBM:mainfrom
chiragjangiir:fix/csp-inline-oninput-members-v2
Open

chiragjangiir wants to merge 1 commit into
IBM:mainfrom
chiragjangiir:fix/csp-inline-oninput-members-v2

Conversation

@chiragjangiir

Copy link
Copy Markdown

Summary

Closes #7283. Supersedes #7292 (which was inadvertently branched from a release tag rather than main, causing base divergence).

In mcpgateway/admin.py, the search inputs in the Manage Members modal and the password validation fields in the user edit modal previously used inline oninput="..." handlers. Under the default Content Security Policy (script-src-attr 'none'), modern browsers block inline event handlers, rendering these inputs inert.

Solution

  • Converted oninput handlers in mcpgateway/admin.py to use data-driven event delegation (data-action-input="debouncedMemberSearch", data-action-input="debouncedNonMemberSearch", and data-action-input="validatePassword").
  • Added input event delegation adapter in mcpgateway/admin_ui/search.js to accept the delegated input event and retrieve event.target.value while defaulting delay cleanly.
  • Exported and wired validatePassword in mcpgateway/admin_ui/teams.js and exposed it via Admin in mcpgateway/admin_ui/admin.js.
  • Added unit tests in tests/unit/js/search.test.js and tests/unit/js/teams.test.js verifying event delegation handling.
  • Added integration test in tests/integration/test_admin_teams_ui.py verifying no inline oninput= is emitted and delegated attributes are present.

Verification

  • Ran Vitest unit tests: tests/unit/js/search.test.js and tests/unit/js/teams.test.js passed (192 tests passing).
  • Ran ESLint: Clean on all touched JS files.
  • Verified diff cleanly contains only the 7 target files with 1 commit ahead of upstream main.

…to comply with CSP (IBM#7283)

Signed-off-by: Chirag Jangir <184008125+chiragjangiir@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: Manage Members search inputs do nothing because CSP blocks inline oninput

1 participant