[JENKINS-74745] [embeddable-build-status] Extract inline event handler in StatusImage

[jenkins-infra-bot]

Problem

== Inline Event Handler (Java)
File: org/jenkinsci/plugins/badge/StatusImage.java
Line: 181
----
onclick=\"window.open(""
----

Solution

https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers

---

Originally reported by basil, imported from: [embeddable-build-status] Extract inline event handler in StatusImage

• assignee: yafenkin
• status: In Review
• priority: Minor
• component(s): embeddable-build-status-plugin
• label(s): CSP
• resolution: Unresolved
• votes: 0
• watchers: 2
• imported: 20251210-235911

Raw content of original issue

Problem


== Inline Event Handler (Java)
File: org/jenkinsci/plugins/badge/StatusImage.java
Line: 181
----
onclick=\"window.open(""
----


Solution
https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers

[jenkins-infra-bot]

• Remote link associated with this issue:

  • PR-424 Extract inline event handler in StatusImage

[jenkins-infra-bot]

danielbeck:

• Original comment link
• Raw content of original comment:

  This image is intended to be rendered outside Jenkins. So while this isn't compatible in the sense that it will (likely) create a CSP violation, that violation on the site embedding the image, which is fairly unlikely to be Jenkins itself.
  

This image is intended to be rendered outside Jenkins. So while this isn't compatible in the sense that it will (likely) create a CSP violation, that violation on the site embedding the image, which is fairly unlikely to be Jenkins itself.