Server: Get rid of all unsafe-eval Javascripts

[Serverfrog]

Get rid of all Javascripts Blocks that are agains the unsafe-eval CSP Rule.
As example the handlebar.js.
Show how that could be possible.

[LukasReschke]

Ref https://github.com/owncloud/core/issues/11925

[LukasReschke]

This seems rather hard to accomplish due to our existing JS code base. As a first step I've added a hardening to jQuery that makes the unsafe-eval in jQuery a non-issue at least: https://github.com/nextcloud/server/pull/3874

[rullzer]

So on my system a quick grep for handlebars compile gives me:

• [x] apps/bruteforcesettings/js/IPWhitelistView.js (https://github.com/nextcloud/bruteforcesettings/pull/20)
• [ ] apps/comments/js/commentsmodifymenu.js
• [ ] apps/comments/js/commentstabview.js
• [ ] apps/comments/js/filesplugin.js
• [ ] apps/external/js/admin.js
• [ ] apps/files_external/js/settings.js
• [ ] apps/files_external/js/statusmanager.js
• [ ] apps/files/js/detailsview.js
• [ ] apps/files/js/fileactions.js
• [ ] apps/files/js/fileactionsmenu.js
• [ ] apps/files/js/filelist.js
• [ ] apps/files/js/filesummary.js
• [ ] apps/files/js/mainfileinfodetailview.js
• [ ] apps/files/js/newfilemenu.js
• [ ] apps/files/js/tagsplugin.js
• [ ] apps/files_sharing/js/files_drop.js
• [ ] apps/files_sharing/js/sharetabview.js
• [ ] apps/files_versions/js/versionstabview.js
• [ ] apps/richdocuments/js/documents.js
• [ ] apps/systemtags/js/systemtagsinfoviewtoggleview.js
• [ ] apps/twofactor_backupcodes/js/settingsview.js
• [ ] apps/twofactor_u2f/js/build/settings.js
• [ ] apps/twofactor_u2f/js/settingsview.js
• [ ] apps/workflowengine/js/admin.js
• [ ] core/js/contactsmenu.js
• [ ] core/js/jquery.contactsmenu.js
• [ ] core/js/sharedialogexpirationview.js
• [ ] core/js/sharedialoglinkshareview.js
• [ ] core/js/sharedialogresharerinfoview.js
• [ ] core/js/sharedialogshareelistview.js
• [ ] core/js/sharedialogview.js
• [ ] core/js/systemtags/systemtagsinputfield.js
• [ ] settings/js/authtoken_view.js
• [ ] settings/js/federationscopemenu.js

[rullzer]

Now we can start doing 2 things.

1. Add compiled handlebars templates
2. Move this over to vue

@nextcloud/javascript your opinion is appreciated

[blizzz]

I prefer consistency over having multiple concurrent solutions in place. Voting for 2.

[rullzer]

We have a stricter CSP in place now. Let me close this.