Remove inline javascript to comply with some CSP

[mossroy]

It does not seem to block the main usage, but the following inline javascript seems to be in every page, and is blocked :

    <script type="text/javascript">
        function extend(obj, src) {
            Object.keys(src).forEach(function(key) { obj[key] = src[key]; });
            return obj;
        }

        var vjs_options = {"techOrder": ["html5", "ogvjs"], "ogvjs": {"base": "assets/vendor/ogvjs"}, "controlBar": {"pictureInPictureToggle":false}};
        // mobile safari won't autoplay muted loop webm
        if (/(mobile|iphone|ipad).*safari*/i.test(navigator.userAgent)) { vjs_options.controls = true;}
        document.querySelectorAll('.video-js').forEach(function(video) {
            var options = extend(vjs_options, {preload: ((video.getAttribute("class") || "").indexOf("youtube") != -1) ? 'none': 'auto'});
            videojs(video, options);
        });
    </script>

[rgaudin]

I'll look into it but wikihow is different to other scrapers in that we mostly copy the main chunk of content from the online source and put it into the ZIM.

In other scraper, we usually manually pick what we're interested in and build a custom template from scratch.

Given the very flexible nature of the mediawiki behind wikihow, there can be inline JS inside articles…

[kelson42]

@rgaudin an we easily secure that our code at least does not have inline js? I’m not sure about the frequency of in,ine js in WikiHow code?

[rgaudin]

@mossroy I've removed our part but many pages have inline JS. Though it should be mostly harmless to just ignore them.

[mossroy]

Thanks!
Let me know when we can test with a new ZIM file

[kelson42]

@mossroy I have restarted https://farm.openzim.org/pipeline/3d47bde79fa420ce696d2026

[mossroy]

This pipeline has failed.
Do we have another newly-generated wikihow ZIM that would include this fix, so that we can test it with kiwix-s?

[rgaudin]

https://farm.openzim.org/pipeline/29564ac9bd2ef43c1fe70226

[mossroy]

Thanks @rgaudin ! I confirm the issue is fixed in this wikihow ZIM file.
I could browse the content (including some with videos), and did not see any blocked inline javascript in Chromium console, with kiwix-js as an extension.

By the way, I opened some very similar issues on other scrapers. See the list in kiwix/kiwix-js#789 (comment)
I know it's some work to fix them, but they're really a problem for us on kiwix-js.