Remove inline javascript to comply with some CSP

[mossroy]

Tested with https://download.kiwix.org/zim/videos/khan-academy-videos_ar_khws-l-dd_2021-12.zim

Every page has the following webp-polyfill related inline code :

<script>$(document).ready(function() { trigger_webp_polyfill(); });</script>

It is blocked when some Content Security Policies ban inline javascript. It is in particular the case in kiwix-js browser extensions.

Moving this line of code in a javascript file should be enough to fix it, in this case.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be now be reviewed manually. Thank you for your contributions.

[benoit74]

I will work on this one today, will open a PR as soon as I have a working proposition.

I intend to test this with KiwixJS installed as an extension on Firefox, is it sufficient or should I test it with something else ?

Do we have a tool ready to test an HTML file for inline javascript ? For now I intend to manually look after :

• <script> tags with no src but inline javascript
• on* events with inline javascript

For now I did not find the "trigger_webp_polyfill" mentioned above in the source code, this might be something trigerred by an external asset, I will look after it.