[JENKINS-74891] Extract inline JavaScript from EmailExtTemplateAction/index.groovy

[yaroslavafenkin]

https://issues.jenkins.io/browse/JENKINS-74891

There's still a problem with the mechanism that renders the template. It's rendered inside an iframe element. Default CSP header that's set by Content Security Policy does not define frame-src, hence default-src is used, which only allows 'self'. This means that data: src for iframe is not allowed, which prohibits templates from being rendered in restrictive mode. This is also be demonstrated on "After the change" video below.

Depending on how wanted this feature is it can either be fixed or deprecated with a notice that it doesn't work in CSP restrictive mode.
Alternatively CSP plugin could define frame-src policy that we'd consider safe (probably a question to @jenkinsci/core-security-review what sources would be safe). I have doubts that data: will make it into the list of safe sources.

Testing done

Before the change
After the change

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[slide]

Could the iframe be replaced with an <object> tag? I am not a web developer by any means, but it looked from googling that it might be possible?

[slide]

I did a quick check with using instead of <iframe> and I see a template rendered correctly, but it does not bypass the issue with CSP as it sets .data on the object tag similar to the src for the iframe. Is there a way to render HTML with CSP enforcement?

[yaroslavafenkin]

I did a quick check with using instead of <iframe> and I see a template rendered correctly, but it does not bypass the issue with CSP as it sets .data on the object tag similar to the src for the iframe. Is there a way to render HTML with CSP enforcement?

I think setting a source for the iframe that falls under 'self' should be compliant. I.e. plugin would directly serve HTML file and set a link to the file as iframe source.

[slide]

I think all of that is outside the scope of this PR, so I'm happy to merge and look at options for full compliance later.