Server: FileSummary (filelist) uses JS Eval

[rullzer]

For https://github.com/orgs/nextcloud/projects/18

The FileSummary uses handlebars and compiles the templates on the fly. This prevents a stricter CSP.

[rullzer]

@nextcloud/javascript seems that the simplest thing here is just moving this to plain javascript. Converting to vue will happen when the whole fiellist is moved to vue.

For now just moving it to plain js is probably easiest and quickest.

[nextcloud-bot]

GitMate.io thinks possibly related issues are https://github.com/nextcloud/server/issues/11029 (Contacts menu uses javascript eval), https://github.com/nextcloud/server/issues/5663 (Custom JS in theme failing: 'unsafe-eval'), https://github.com/nextcloud/server/issues/8089 (Filelist not updated in Groupfolder), https://github.com/nextcloud/server/issues/4487 (JS tests failing on CI), and https://github.com/nextcloud/server/pull/11023 (Bump JS deps Accessibility).

[blizzz]

thus, handlebars tempalte compilation in general is evil?

[rullzer]

thus, handlebars tempalte compilation in general is evil?

@blizzz not by definition. Unsafe eval is evil :wink: . You can also compile your templates and upload the compiled js and use the templates then.

[blizzz]

we didn't do ship precompiled templates because $forgotten_issues