Skip to content

fix: Use Web Crypto compatible function for nonce generation - v2 #818

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

andreituicu
Copy link
Collaborator

@andreituicu andreituicu commented Feb 12, 2025

Currently trying to serve a page with nonce CSP results in 500 in cloudflare:
Worker: x-error: crypto_worker_default2.randomBytes is not a function

Deployed the fix and tested in Cloudflare:

curl ${CLOUFLARE_CI_ENDPOINT}/preview/adobe/helix-labs-website/csp-nonce/  -v

< HTTP/2 200 
< date: Thu, 13 Feb 2025 00:16:57 GMT
< content-type: text/html; charset=utf-8
< content-length: 12006
< last-modified: Thu, 13 Feb 2025 00:16:47 GMT
< content-security-policy: script-src 'nonce-avl5oxNCQ0axF7vcbunZIkl1' 'strict-dynamic'; base-uri 'self'; object-src 'none';
...
<!DOCTYPE html>
<html>
  <head>
    <title>Home | Admin Labs</title>
    ...
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script nonce="avl5oxNCQ0axF7vcbunZIkl1" src="/scripts/aem.js" type="module"></script>
    <script nonce="avl5oxNCQ0axF7vcbunZIkl1" src="/scripts/scripts.js" type="module"></script>
    ...
  </head>
  <body>
    ...
  </body>
</html>

Copy link

codecov bot commented Feb 12, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (3f4895f) to head (3542d7d).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #818   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           46        46           
  Lines         3914      3923    +9     
=========================================
+ Hits          3914      3923    +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Comment on lines +507 to 515
beforeEach(() => {
uuidIdx = 0;
// eslint-disable-next-line no-plusplus
cryptoImpl.randomUUID = () => uuids[uuidIdx++];
});

it('renders document with many image references quickly', async () => {
await testRender('gt-many-refs');
afterEach(() => {
cryptoImpl.randomUUID = originalRandomUUID;
});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this better than esmock...

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's discuss here: #817 (comment)
Yes, the v2 is simply because randomUUID is easier to mock, but makes the implementation of the actual nonce generation a little more complex.

@andreituicu andreituicu deleted the fix-csp-nonce branch February 13, 2025 16:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants