[JENKINS-74686] [arestocats] Extract inline script block in org/jenkinsci/plugins/arestocats/ArestocatsMetricsAction/index.jelly

Problem

```
== Inline Script Block
Line: 9
----

var results = ${it.metrics};
console.log(results);
var charts = [];
google.charts.load('current', {'packages':['corechart']});
google.charts.setOnLoadCallback(drawCharts);
function drawCharts(){
results.forEach( ( result ) => {
var data = new google.visualization.DataTable();
data.addColumn( 'string', 'X' );
var testcase = Object.keys(result)[0];
var measurements = result[testcase];
var labeling = measurements["names"];
labeling.forEach( label => {
data.addColumn( 'number', label );
});
data.addRows(measurements["data"]);
var options = {
'title': testcase,
chartArea: {
left: 100,
width: 600
},
width: 1000,
hAxis: {
title: 'Build Nr.'
},
vAxis: {
title: measurements["label"]
}
};
var div = document.createElement( "div" );
div.setAttribute( "id", testcase );
document.getElementById( "main-panel" ).appendChild( div );
var chart = new google.visualization.LineChart( document.getElementById( testcase ) );
chart.draw( data, options );
charts.push( chart );
} );
}

----

```

Solution

https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks

---
Originally reported by basil, imported from: [arestocats] Extract inline script block in org/jenkinsci/plugins/arestocats/ArestocatsMetricsAction/index.jelly

• status: Open
  
• priority: Minor
  
• component(s): _unsorted
  
• label(s): CSP
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-08
  

Raw content of original issue

Problem




== Inline Script Block

Line: 9

----

<script type="text/javascript">

               var results = ${it.metrics};

               console.log(results);

               var charts = [];

               google.charts.load('current', {'packages':['corechart']});

               google.charts.setOnLoadCallback(drawCharts);

               function drawCharts(){

                  results.forEach( ( result ) => {

                     var data = new google.visualization.DataTable();

                     data.addColumn( 'string', 'X' );

                     var testcase = Object.keys(result)[0];

                     var measurements = result[testcase];

                     var labeling = measurements["names"];

                     labeling.forEach( label => {

                     data.addColumn( 'number', label );

                     });

                    data.addRows(measurements["data"]);

                     var options = {

                         'title': testcase,

                         chartArea: {

                             left: 100,

                             width: 600

                         },

                         width: 1000,

                         hAxis: {

                             title: 'Build Nr.'

                         },

                         vAxis: {

                             title:  measurements["label"]

                         }

                     };

                     var div = document.createElement( "div" );

                     div.setAttribute( "id", testcase );

                     document.getElementById( "main-panel" ).appendChild( div );

                     var chart = new google.visualization.LineChart( document.getElementById( testcase ) );

                     chart.draw( data, options );

                     charts.push( chart );

                  } );

               }

            </script>

----





Solution


https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks

Start with org/jenkinsci/plugins/arestocats/ArestocatsMetricsAction/index.jelly and the Jenkins CSP guidance linked in the issue. Identify how the inline script block is currently used and move it out of the Jelly view without changing the chart behavior. Done means the inline script block is removed from index.jelly and the metrics charts still render.

Written by the indexing model from the issue text.