tree 4c0a65e06d0e53c57df0e74279ca812a21f3a6c6
parent ba97b456d4db19ec43a1e32ca31cd123dfc16f99
author Ben Rohlfs <brohlfs@google.com> 1703263218 +0100
committer Ben Rohlfs <brohlfs@google.com> 1703263218 +0100

Remove support for INJECT_JS_PLUGIN and INJECT_JS_MODULE_PLUGIN

Content Security Policy for extensions does not allow injecting
arbitrary JS.

We have considered passing a list of URLs from the extension to the
web app instead, but that is non-trivial to do, because they also
cannot access the `window` object of each other. The extension could
add an element to the DOM and set an attribute on that. The web app
would then read the attribute and load those plugins instead of the
ones listed in the server config. Apart from adding complexity the
disadvantage is that the web app would have to be changed, and thus
you could not use the concept for existing open source servers.

There is a trivial workaround though: You can just redirect an exsiting
plugin to your new plugin. Every Gerrit server typically has a plugin
that can be replaced during development, so this is not much of a
limitation.

Google-Bug-Id: b/317481553
Release-Notes: Remove INJECT_JS_PLUGIN and INJECT_JS_MODULE_PLUGIN
Change-Id: If954960ad56aba5595c6ec029ce8211fcb6ec5b0