[SOLR-13987] Admin UI should not rely on javascript eval()

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.4
• Component/s: Admin UI
• Assignee: Kevin Risden
• Reporter: Robert Muir
• Created: 30/Nov/19 19:28
• Updated: 25/Jan/20 03:15
• Resolved: 07/Dec/19 21:53

Description

Followup from SOLR-13982: currently any CSP is weak because it must allow this eval: means arbitrary javascript can still be executed.

Let's fix the admin UI to not require eval so it can be disabled by the browser.

Issue Links

• is related to: SOLR-14039 SOLR-13987 broke multiple node /select handler due to jetty.xml whitespace
• relates to: SOLR-14176 Graph of SolrCloud is not shown in UI
• relates to: SOLR-13982 set security-related http response headers by default
• relates to: SOLR-14014 Allow Solr to start with Admin UI disabled
• links to: GitHub Pull Request #1066