Add CSP to local web UI forbidding JavaScript eval()

radicale/web/internal_data/js/main.js

@@ -19,12 +19,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { LoginScene } from "./scenes/LoginScene.js";
 import { LoadingScene } from "./scenes/LoadingScene.js";
+import { LoginScene } from "./scenes/LoginScene.js";
 import { push_scene } from "./scenes/scene_manager.js";
+import { setupSelectAll } from "./utils/misc.js";
+
+// Add selection handler for input fields with 'selectall' class.
+setupSelectAll();
 
 // Hide startup loading message
 // This works because the LoadingScene is the one that is already active in index.html,
 // and all other scenes are hidden.
 new LoadingScene().hide();
-push_scene(new LoginScene());
+push_scene(new LoginScene());
+

radicale/web/internal_data/js/utils/misc.js

@@ -108,3 +108,14 @@ export function bytesToHumanReadable(bytes) {
     i = Math.min(i, units.length - 1);
     return Math.round((bytes / Math.pow(1024, i)) * 100) / 100 + ' ' + units[i];
 }
+
+/**
+ * Add selection handler for input fields with 'selectall' class.
+ */
+export function setupSelectAll() {
+    document.addEventListener("focusin", (event) => {
+        if (event.target instanceof HTMLInputElement && event.target.classList.contains("selectall")) {
+            event.target.setSelectionRange(0, 99999);
+        }
+    });
+}