diff --git a/src/steps/csp.js b/src/steps/csp.js
index aeac9bb2..ad91a176 100644
--- a/src/steps/csp.js
+++ b/src/steps/csp.js
@@ -111,9 +111,15 @@ function createAndApplyNonceOnAST(res, tree, metaCSP, headerCSP, headerCSPRO) {
}
visit(tree, (node) => {
- if (scriptNonce && node.tagName === 'script' && node.properties?.nonce === 'aem') {
- node.properties.nonce = nonce;
- return;
+ if (scriptNonce) {
+ if (node.tagName === 'script' && node.properties?.nonce === 'aem') {
+ node.properties.nonce = nonce;
+ return;
+ }
+ if (node.tagName === 'link' && node.properties?.as === 'script' && node.properties?.nonce === 'aem') {
+ node.properties.nonce = nonce;
+ return;
+ }
}
if (styleNonce
@@ -222,14 +228,34 @@ export function contentSecurityPolicyOnCode(state, res) {
}
}
- if (scriptNonce && tag.tagName === 'script' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) {
- chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`));
- return;
+ if (scriptNonce) {
+ if (tag.tagName === 'script' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) {
+ chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`));
+ return;
+ }
+
+ if (tag.tagName === 'link'
+ && tag.attrs.find((attr) => attr.name === 'as' && attr.value === 'script')
+ && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')
+ ) {
+ chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`));
+ return;
+ }
}
- if (styleNonce && (tag.tagName === 'style' || tag.tagName === 'link') && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) {
- chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`));
- return;
+ if (styleNonce) {
+ if (tag.tagName === 'style' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) {
+ chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`));
+ return;
+ }
+
+ if (tag.tagName === 'link'
+ && tag.attrs.find((attr) => attr.name === 'rel' && attr.value === 'stylesheet')
+ && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')
+ ) {
+ chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`));
+ return;
+ }
}
chunks.push(getRawHTML(tag));
diff --git a/test/fixtures/code/super-test/static-nonce-fragment.html b/test/fixtures/code/super-test/static-nonce-fragment.html
index c8f32793..5e153422 100644
--- a/test/fixtures/code/super-test/static-nonce-fragment.html
+++ b/test/fixtures/code/super-test/static-nonce-fragment.html
@@ -1,4 +1,5 @@
+
Nonce Test
diff --git a/test/fixtures/code/super-test/static-nonce-fragment.ref.html b/test/fixtures/code/super-test/static-nonce-fragment.ref.html
index 21cbd4a5..57a89f54 100644
--- a/test/fixtures/code/super-test/static-nonce-fragment.ref.html
+++ b/test/fixtures/code/super-test/static-nonce-fragment.ref.html
@@ -1,4 +1,5 @@
+
Nonce Test
diff --git a/test/fixtures/code/super-test/static-nonce-header.html b/test/fixtures/code/super-test/static-nonce-header.html
index dabff8fa..4547793e 100644
--- a/test/fixtures/code/super-test/static-nonce-header.html
+++ b/test/fixtures/code/super-test/static-nonce-header.html
@@ -14,6 +14,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-header.ref.html b/test/fixtures/code/super-test/static-nonce-header.ref.html
index 5ee83800..e49e2f7b 100644
--- a/test/fixtures/code/super-test/static-nonce-header.ref.html
+++ b/test/fixtures/code/super-test/static-nonce-header.ref.html
@@ -14,6 +14,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.html b/test/fixtures/code/super-test/static-nonce-meta-different.html
index b660b86f..078310f2 100644
--- a/test/fixtures/code/super-test/static-nonce-meta-different.html
+++ b/test/fixtures/code/super-test/static-nonce-meta-different.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html
index b660b86f..078310f2 100644
--- a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html
+++ b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html
index 70cbe1a7..8696e713 100644
--- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html
+++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html
index 7a8b1c19..cb53ef91 100644
--- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html
+++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-meta.html b/test/fixtures/code/super-test/static-nonce-meta.html
index 4a3e2a06..f4e2be06 100644
--- a/test/fixtures/code/super-test/static-nonce-meta.html
+++ b/test/fixtures/code/super-test/static-nonce-meta.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/code/super-test/static-nonce-meta.ref.html b/test/fixtures/code/super-test/static-nonce-meta.ref.html
index 9fb09c12..4d84b41b 100644
--- a/test/fixtures/code/super-test/static-nonce-meta.ref.html
+++ b/test/fixtures/code/super-test/static-nonce-meta.ref.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/content/nonce-headers-different.html b/test/fixtures/content/nonce-headers-different.html
index ce02bb02..fbf4f295 100644
--- a/test/fixtures/content/nonce-headers-different.html
+++ b/test/fixtures/content/nonce-headers-different.html
@@ -14,6 +14,7 @@
+
diff --git a/test/fixtures/content/nonce-headers-meta.html b/test/fixtures/content/nonce-headers-meta.html
index 547995dc..499c9a46 100644
--- a/test/fixtures/content/nonce-headers-meta.html
+++ b/test/fixtures/content/nonce-headers-meta.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/content/nonce-headers.html b/test/fixtures/content/nonce-headers.html
index f941a05b..dcab792f 100644
--- a/test/fixtures/content/nonce-headers.html
+++ b/test/fixtures/content/nonce-headers.html
@@ -14,6 +14,7 @@
+
diff --git a/test/fixtures/content/nonce-meta-different.html b/test/fixtures/content/nonce-meta-different.html
index c5505253..bf234f8f 100644
--- a/test/fixtures/content/nonce-meta-different.html
+++ b/test/fixtures/content/nonce-meta-different.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/content/nonce-meta-move-as-header.html b/test/fixtures/content/nonce-meta-move-as-header.html
index 8733139a..b59d489b 100644
--- a/test/fixtures/content/nonce-meta-move-as-header.html
+++ b/test/fixtures/content/nonce-meta-move-as-header.html
@@ -14,6 +14,7 @@
+
diff --git a/test/fixtures/content/nonce-meta.html b/test/fixtures/content/nonce-meta.html
index f6d3289e..d00a53df 100644
--- a/test/fixtures/content/nonce-meta.html
+++ b/test/fixtures/content/nonce-meta.html
@@ -15,6 +15,7 @@
+
diff --git a/test/fixtures/content/nonce-script-only.html b/test/fixtures/content/nonce-script-only.html
index 50b5d03c..e83613e8 100644
--- a/test/fixtures/content/nonce-script-only.html
+++ b/test/fixtures/content/nonce-script-only.html
@@ -14,6 +14,7 @@
+
diff --git a/test/rendering.test.js b/test/rendering.test.js
index 7ef9650c..1383ac7b 100644
--- a/test/rendering.test.js
+++ b/test/rendering.test.js
@@ -593,6 +593,7 @@ describe('Rendering', () => {
head: {
// eslint-disable-next-line quotes
html: `\n`
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -617,7 +618,8 @@ describe('Rendering', () => {
],
},
head: {
- html: '\n'
+ html: '\n'
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -642,7 +644,8 @@ describe('Rendering', () => {
],
},
head: {
- html: '\n'
+ html: '\n'
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -660,6 +663,7 @@ describe('Rendering', () => {
head: {
// eslint-disable-next-line quotes
html: `\n`
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -686,6 +690,7 @@ describe('Rendering', () => {
head: {
// eslint-disable-next-line quotes
html: `\n`
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -710,7 +715,8 @@ describe('Rendering', () => {
],
},
head: {
- html: '\n'
+ html: '\n'
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -728,6 +734,7 @@ describe('Rendering', () => {
head: {
// eslint-disable-next-line quotes
html: `\n`
+ + '\n'
+ '\n'
+ '\n'
+ '\n'
@@ -752,7 +759,8 @@ describe('Rendering', () => {
],
},
head: {
- html: '\n'
+ html: '\n'
+ + '\n'
+ '\n'
+ '\n'
+ '\n'