Remove __riverUiBasePath and __riverUiAssetUrl global functions #382
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR eliminates Content Security Policy issues by replacing global JavaScript functions with a JSON configuration approach for path resolution. The change removes inline script execution while maintaining the same functionality for determining the application's base path.
- Remove global
__riverUiBasePathand__riverUiAssetUrlfunctions from index.html - Replace global function usage with a
getBasePath()function that reads from JSON config - Update changelog to document the CSP-related fix
Reviewed Changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/App.tsx | Adds getBasePath() function to read base path from JSON config instead of global functions |
| public/index.html | Removes inline script defining global functions |
| CHANGELOG.md | Documents the removal of global functions for CSP compliance |
bgentry
reviewed
Jul 24, 2025
Contributor
bgentry
left a comment
There was a problem hiding this comment.
Thanks @jmfederico! I think I'm going to have to test this locally to make sure all the scenarios work fine as that doesn't all have great coverage yet.
Meanwhile, could you please add yourself to the CLA? 🙏
Contributor
Author
Contributor
Author
|
Hi! Is there anyway I can help with making this PR move forward? |
Replace global function usage with config JSON approach to eliminate CSP issues. - Remove global function definitions from index.html - Update App.tsx to read basepath from config__json element - Remove global function type definitions from TypeScript types - Maintain backward compatibility by falling back to '/' if config unavailable This change eliminates Content Security Policy problems by removing the need for inline script execution while preserving all existing functionality.
Since we no longer have any global window functions, the Window interface extension is not needed anymore.
Document the removal of global functions that eliminates Content Security Policy issues in the Unreleased section.
e16998e to
06be292
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Replace global function usage with config JSON approach to eliminate CSP issues.
This change eliminates Content Security Policy problems by removing the need for inline script execution while preserving all existing functionality.