Injecting JS in description of custom fields

[Gowri_Sankar]

Hi All,

I have read some articles that java script can be added for a custom field in 

1. Announcement Banner

2. Under description of each of the custom field.

Since, placing the JS in announcement banner will affect the whole JIRA irrespective of the issue types. Is ir advisable to have javascript code under the description of a custom field?

With reference to https://community.atlassian.com/t5/Jira-questions/javascript-inject-in-custom-fields-in-jira-7/qaq-p/170592

It is mentioned that JIRA is removing the ability to run arbitrary code in description. Kindly advise.

Currently we are using JIRA 8.x.

With Regards,

Gowri Sankar 

[Nic Brough -Adaptavist- · Accepted solution]

You can expect the injected javascript in descriptions to go away, leaving only the banner option (note that you can't do it at all on Cloud)

I would strongly recommend not injecting any at all.  It often doesn't what you want it to, is very hard to maintain, is ignored by REST, and usually only partially applies to parts of the UI.  It's ok-ish for global actions, but I wouldn't try to use it for "enhancing" fields.

[Gowri_Sankar]

Hi @Nic Brough -Adaptavist- ,

Thank you for the quick suggestion. Can we use any plugins for including JS for the custom fields. If so, please suggest with some good plugin to include JS.

[david_parry]

I have done this before myself because I couldnt find "cheap" plugins to do it for a 2k user-base (and I'm a programmer too so knew how to write the code to not kill the platform)

Field-schemas allow overriding of the field-description for say specific projects.

I used to follow that approach when injecting scripted HTML to augment field descriptions (eg render a popup showing a calculation, or auto-render HTML links out to reference documentation based on other fields in the ticket). At least then if there was a performance hit it wouldnt hit the whole user-base: just that project and could be turned on/off quickly to determine if that was the thing cauysing performance issues.

I'm guessing Atlassian simply dont want that as a scripted attack vector on JIRA cloud... and the change is propagating out to the other platform versions.