Customer's Plugins do not work anymore when activating the new CSP support for removeUnsafeEval and removeUnsafeInline

Please refer to ICN Forums here for details:
https://github.ibm.com/ECM-Forums/icn-internal-forum/issues/181

A customer's Development team opened a Case with the following Problem Description:

===================================================
We are developing large plugins for IBM Content Navigator. After consulting your document regarding changes due to Content Security Policy (CSP) (https://www.ibm.com/support/pages/content-security-policy-csp-enhancements-safe-resilient-plugin-development), we tested it, set both JVM properties to "true," and found issues in your IBM Content Navigator code. The issues arise from setting the Dojo "async" property to "true," as required for CSP to function, causing modules to load asynchronously.

The first issue is that you still have "require" calls within your code that do not use a callback or deferred. For example, the method "Desktop._loadActionsRecursive" causes the "BannerUserSessionContextMenu" to stop working if a simple plugin action is added to this menu that utilizes an action model class.

The second, more concerning issue pertains to plugin initialization. Both our client and ourselves add aspects to your code. We include some during the "startup" of the application, such as "Desktop.onDesktopLoaded" or "Desktop.onLogin." Previously, it was ensured that these aspects were registered before those methods were called because the plugins loaded synchronously. This is no longer the case, as the "require" is asynchronous, and all aspects might not be set when these methods are called. Therefore, the aspects will never be invoked. From our perspective, you need to ensure that the plugin modules are fully loaded in "Desktop._initializePlugins" before proceeding to call "Desktop._desktopLoaded." While we found the flag "plugin.awaitScriptLoad" in your code, it uses a hardcoded timeout of 10 seconds. This logic causes fast-loading plugins to wait unnecessarily and slower-loading plugins to fail if aspects are not registered in time.

We have implemented a "dirty" workaround for the second issue concerning plugin loading. Perhaps it can assist you in finding a solution.

Firstly, we add an "aspect.around" to "Desktop._desktopLoaded" to wait in an interval for plugins that have "awaitScriptLoad" set until each of them has a variable "plugin.scriptLoaded" set to true:

require(["dojo/aspect", "dojo/_base/lang", "ecm/model/Desktop"], function (aspect, lang) {
const checkPluginsLoaded = function () {
if (!ecm.model.desktop._plugins || !ecm.model.desktop._pluginsInitialized) {
return false;
}
for (const plugin of ecm.model.desktop._plugins) {
if (plugin.awaitScriptLoad && !plugin.scriptLoaded) {
return false;
}
}
return true;
};

aspect.around(ecm.model.desktop, "_desktopLoaded", function (originalMethod) {
return function (response, callback) {
if (!ecm.model.desktop.scriptLoadedIntervalId) {
ecm.model.desktop.scriptLoadedIntervalId = setInterval(function () {
console.log("------------------>>>>>>>>>>>>> _desktopLoaded waiting <<<<<<<<<<<<<<<<-----------------------");
if (checkPluginsLoaded()) {
ecm.model.desktop.allScriptsLoaded = true;
console.log("------------------>>>>>>>>>>>>> _desktopLoaded scripts loaded <<<<<<<<<<<<<<<<-----------------------");
clearInterval(ecm.model.desktop.scriptLoadedIntervalId);
return lang.hitch(ecm.model.desktop, originalMethod)(response, callback);
}
}, 250);
} else if (ecm.model.desktop.allScriptsLoaded) {
return lang.hitch(ecm.model.desktop, originalMethod)(response, callback);
}
};
});
});

Now, each plugin that uses "awaitScriptLoad" needs to set its "plugin.scriptLoaded" flag to "true" like this:

require(["require1","require2","require3","require4", ...], function (require1,require2,require3,require4, ...) {

// pluigin code like adding aspects goes here

//
for (const plugin of ecm.model.desktop._plugins) {
if (plugin.id === "MyPluginId") {
plugin.scriptLoaded = true;
}
}
});

Using this workaround ensures that "Desktop._desktopLoaded" is only called if all plugins indicate that they are loaded and all aspects are functioning.

We hope this helps you address the issues with CSP, making it usable for all plugin developers creating custom plugins. The issue still exists in 3.0.15 if002.

==============================================================