From 5a2a1660585ee5562d3b1fe1e3d209bc3b34e0e0 Mon Sep 17 00:00:00 2001
From: Yaroslav Afenkin <91559310+yaroslavafenkin@users.noreply.github.com>
Date: Tue, 22 Oct 2024 18:20:30 +0300
Subject: [PATCH 1/3] [JENKINS-73949] Extract inline event handlers from
 LockableResourcesRootAction/tableResources/table.jelly

---
 .../tableResources/table.jelly                | 27 ++++++++++---------
 src/main/webapp/js/lockable-resources.js      | 18 +++++++++++--
 2 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/src/main/resources/org/jenkins/plugins/lockableresources/actions/LockableResourcesRootAction/tableResources/table.jelly b/src/main/resources/org/jenkins/plugins/lockableresources/actions/LockableResourcesRootAction/tableResources/table.jelly
index f56e783c..b9fc830f 100644
--- a/src/main/resources/org/jenkins/plugins/lockableresources/actions/LockableResourcesRootAction/tableResources/table.jelly
+++ b/src/main/resources/org/jenkins/plugins/lockableresources/actions/LockableResourcesRootAction/tableResources/table.jelly
@@ -91,7 +91,8 @@ THE SOFTWARE.
                 </div>
                 <div class="col-auto jenkins-!-margin-right-2">
                   <l:hasPermission permission="${it.RESERVE}">
-                    <a class="jenkins-table__link" id="note-link" href="editNote" onclick="return replaceNote(this, '${resource.name}');">
+                    <a class="jenkins-table__link lockable-resources-replace-note" data-resource-name="${resource.name}"
+                       id="note-link" href="editNote">
                       <l:icon class="symbol-edit-note icon-sm" />
                       ${%btn.editNote}
                     </a>
@@ -251,8 +252,8 @@ THE SOFTWARE.
                 <j:when test="${resource.locked}">
                   <l:hasPermission permission="${it.UNLOCK}">
                     <button
-                      onClick="resource_action(this, 'unlock');"
-                      class="jenkins-button j.jenkins-!-warning-color"
+                      data-action="unlock"
+                      class="jenkins-button j.jenkins-!-warning-color lockable-resources-action-button"
                       tooltip="${%btn.unlock.detail}"
                     >
                       ${%btn.unlock}
@@ -260,8 +261,8 @@ THE SOFTWARE.
                   </l:hasPermission>
                   <l:hasPermission permission="${it.STEAL}">
                     <button
-                      onClick="resource_action(this, 'steal');"
-                      class="jenkins-button jenkins-!-destructive-color"
+                      data-action="steal"
+                      class="jenkins-button jenkins-!-destructive-color lockable-resources-action-button"
                       tooltip="${%btn.steal.detail}"
                     >
                       ${%btn.steal}
@@ -272,8 +273,8 @@ THE SOFTWARE.
                   <l:hasPermission permission="${it.RESERVE}">
                     <j:if test="${resource.isReservedByCurrentUser() or h.hasPermission(app.ADMINISTER)}">
                       <button
-                        onClick="resource_action(this, 'unreserve');"
-                        class="jenkins-button jenkins-!-success-color"
+                        data-action="unreserve"
+                        class="jenkins-button jenkins-!-success-color lockable-resources-action-button"
                         tooltip="${%btn.unReserve.detail}"
                       >
                         ${%btn.unReserve}
@@ -283,8 +284,8 @@ THE SOFTWARE.
                   <l:hasPermission permission="${it.STEAL}">
                     <j:if test="${!resource.isReservedByCurrentUser()}">
                       <button
-                        onClick="resource_action(this, 'reassign');"
-                        class="jenkins-button jenkins-button--primary"
+                        data-action="reassign"
+                        class="jenkins-button jenkins-button--primary lockable-resources-action-button"
                         tooltip="${%btn.reassign.detail}"
                       >
                         ${%btn.reassign}
@@ -295,8 +296,8 @@ THE SOFTWARE.
                 <j:when test="${resource.queued}">
                   <l:hasPermission permission="${it.UNLOCK}">
                     <button
-                      onClick="resource_action(this, 'reset');"
-                      class="jenkins-button jenkins-!-destructive-color"
+                      data-action="reset"
+                      class="jenkins-button jenkins-!-destructive-color lockable-resources-action-button"
                       tooltip="${%btn.reset.detail}"
                     >
                       ${%btn.reset}
@@ -306,8 +307,8 @@ THE SOFTWARE.
                 <j:otherwise>
                   <l:hasPermission permission="${it.RESERVE}">
                     <button
-                      onClick="resource_action(this, 'reserve');"
-                      class="jenkins-button jenkins-button--primary"
+                      data-action="reserve"
+                      class="jenkins-button jenkins-button--primary lockable-resources-action-button"
                       tooltip="${%btn.reserve.detail}"
                     >
                       ${%btn.reserve}
diff --git a/src/main/webapp/js/lockable-resources.js b/src/main/webapp/js/lockable-resources.js
index 3258bcc6..cd1059d5 100644
--- a/src/main/webapp/js/lockable-resources.js
+++ b/src/main/webapp/js/lockable-resources.js
@@ -59,7 +59,7 @@ function resource_action(button, action) {
   });
 }
 
-function replaceNote(element, resourceName) {
+function replaceNote(resourceName) {
   var d = document.getElementById("note-" + resourceName);
   d.innerHTML = "<div class='spinner-right' style='flex-grow: 1;'>loading...</div>";
   fetch("noteForm", {
@@ -80,7 +80,6 @@ function replaceNote(element, resourceName) {
       layoutUpdateCallback.call();
     });
   });
-  return false;
 }
 
 function format(d) {
@@ -146,6 +145,21 @@ jQuery(document).ready(function () {
       tr.addClass('shown');
     }
   });
+
+  document.querySelectorAll(".lockable-resources-action-button").forEach(function(button) {
+    button.addEventListener("click", function(event) {
+      const target = event.target;
+      const action = target.dataset.action;
+      resource_action(target, action);
+    });
+  });
+
+  document.querySelectorAll(".lockable-resources-replace-note").forEach(function(anchor) {
+    anchor.addEventListener("click", function(event) {
+      event.preventDefault();
+      replaceNote(event.target.dataset.resourceName);
+    });
+  });
 });
 
 

From b5d8ee034fcf0a822e6c4822048b2a994a3011e7 Mon Sep 17 00:00:00 2001
From: Yaroslav Afenkin <91559310+yaroslavafenkin@users.noreply.github.com>
Date: Tue, 22 Oct 2024 18:55:47 +0300
Subject: [PATCH 2/3] Make the failing test pass

---
 .../LockableResourceRootActionSEC1361Test.java                | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/jenkins/plugins/lockableresources/LockableResourceRootActionSEC1361Test.java b/src/test/java/org/jenkins/plugins/lockableresources/LockableResourceRootActionSEC1361Test.java
index 325445c2..2bff7db1 100644
--- a/src/test/java/org/jenkins/plugins/lockableresources/LockableResourceRootActionSEC1361Test.java
+++ b/src/test/java/org/jenkins/plugins/lockableresources/LockableResourceRootActionSEC1361Test.java
@@ -80,8 +80,8 @@ private void checkXssWithResourceName(String resourceName) throws Exception {
 
         HtmlElement reserveButton = null;
         for (HtmlElement b : allButtons) {
-            String onClick = b.getAttribute("onClick");
-            if (onClick != null && onClick.contains("reserve")) {
+            String action = b.getAttribute("data-action");
+            if (action != null && action.contains("reserve")) {
                 reserveButton = b;
             }
         }

From c7d90c43b2a6002bfc1e178723517fc998560e43 Mon Sep 17 00:00:00 2001
From: Basil Crow <me@basilcrow.com>
Date: Tue, 22 Oct 2024 09:30:20 -0700
Subject: [PATCH 3/3] Consistent formatting with the rest of this file

---
 src/main/webapp/js/lockable-resources.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/main/webapp/js/lockable-resources.js b/src/main/webapp/js/lockable-resources.js
index cd1059d5..bc2c30d1 100644
--- a/src/main/webapp/js/lockable-resources.js
+++ b/src/main/webapp/js/lockable-resources.js
@@ -146,16 +146,16 @@ jQuery(document).ready(function () {
     }
   });
 
-  document.querySelectorAll(".lockable-resources-action-button").forEach(function(button) {
-    button.addEventListener("click", function(event) {
+  document.querySelectorAll(".lockable-resources-action-button").forEach(function (button) {
+    button.addEventListener("click", function (event) {
       const target = event.target;
       const action = target.dataset.action;
       resource_action(target, action);
     });
   });
 
-  document.querySelectorAll(".lockable-resources-replace-note").forEach(function(anchor) {
-    anchor.addEventListener("click", function(event) {
+  document.querySelectorAll(".lockable-resources-replace-note").forEach(function (anchor) {
+    anchor.addEventListener("click", function (event) {
       event.preventDefault();
       replaceNote(event.target.dataset.resourceName);
     });