I have tested this item ✅ successfully on e75acd1

I have tested this item ✅ successfully on e75acd1

__

RTC

Inline javascript should be avoided, onclick is a potentially XSS

Back to pending due to previous comment.

Inline javascript should be avoided, onclick is a potentially XSS

I read that somewhere. But there are 170 instances of onclick in the administrator/components ... what should I do?

I read that somewhere. But there are 170 instances of onclick in the administrator/components ... what should I do?

Maybe so: OutputFilter::ampReplace ???

See example:

OR ???

use Joomla\CMS\Factory;

/** @var Joomla\CMS\WebAsset\WebAssetManager $wa */
$wa = Factory::getApplication()->getDocument()->getWebAssetManager();

// Add inline JavaScript
$wa->addInlineScript('
    document.addEventListener("DOMContentLoaded", function(event) {
        alert("An inline JavaScript Declaration");
    });
');

See https://docs.joomla.org/J4.x:Http_Header_Management

I have tested this item ? unsuccessfully on e75acd1

non-sanitised inline scripts are not safe

Inline javascript should be avoided, onclick is a potentially XSS

I read that somewhere. But there are 170 instances of onclick in the administrator/components ... what should I do?

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/33644.

replace them all with <button></button> ? Most of them shouldn't be an <a></a>. And start with this one...

I remembered where I read about not using onclick and the like - it is in CSP documentation. Closing this - I may come with a CSP compliant implementation.