[security] Fix AJAX Loading of Inline Scripts in editFile

desktop/core/src/desktop/static/desktop/js/file-display-inline.js

@@ -202,17 +202,29 @@
     self.editFile = function() {
       self.isViewing(false);
       self.isLoading(true);
-
       const encodedPath = encodeURIComponent(FileViewOptions['path']);
       $.ajax({
         url: '/filebrowser/edit=' + encodedPath + '?is_embeddable=true',
-        beforeSend:function (xhr) {
+        beforeSend: function(xhr) {
           xhr.setRequestHeader('X-Requested-With', 'Hue');
         },
-        dataType:'html',
-        success:function (response) {
-          $('#fileeditor').html(response);
-          self.isLoading(false);
+        dataType: 'html',
+        success: function(response) {
+          const $response = $('<div>').html(response);
+          const scripts = $response.find('script').remove().toArray();
+          $('#fileeditor').html($response.html());
+          scripts.forEach(function(scriptTag) {
+            var script = document.createElement('script');
+            script.type = 'text/javascript';
+            script.src = scriptTag.src;
+            document.head.appendChild(script);
+          });
+        },
+        error: function(xhr, status, error) {
+          console.error("Error loading file editor:", error);
+        },
+        complete: function() {
+          self.isLoading(false); 
         }
       });
     }

desktop/core/src/desktop/static/desktop/js/task-browser-inline.js

@@ -0,0 +1,3 @@
+(function () {
+  window.createReactComponents('#taskbrowser-container');
+})();

desktop/core/src/desktop/templates/taskserver_list_tasks.mako

@@ -22,11 +22,7 @@ ${ layout.menubar(section='task_server') }
 <div class="container-fluid">
   <div class="card card-small">
 
-    <script type="text/javascript">
-      (function () {
-        window.createReactComponents('#taskbrowser-container');
-      })();
-    </script>
+    <script src="${ static('desktop/js/task-browser-inline.js') }" type="text/javascript"></script>
 
     <div id="taskbrowser-container">
       <MyComponent data-reactcomponent='TaskBrowser' data-props='{"myObj": {"id": 1}, "children": "mako template only", "version" : "${sys.version_info[0]}"}' ></MyComponent>