diff --git a/src/steps/csp.js b/src/steps/csp.js index aeac9bb2..ad91a176 100644 --- a/src/steps/csp.js +++ b/src/steps/csp.js @@ -111,9 +111,15 @@ function createAndApplyNonceOnAST(res, tree, metaCSP, headerCSP, headerCSPRO) { } visit(tree, (node) => { - if (scriptNonce && node.tagName === 'script' && node.properties?.nonce === 'aem') { - node.properties.nonce = nonce; - return; + if (scriptNonce) { + if (node.tagName === 'script' && node.properties?.nonce === 'aem') { + node.properties.nonce = nonce; + return; + } + if (node.tagName === 'link' && node.properties?.as === 'script' && node.properties?.nonce === 'aem') { + node.properties.nonce = nonce; + return; + } } if (styleNonce @@ -222,14 +228,34 @@ export function contentSecurityPolicyOnCode(state, res) { } } - if (scriptNonce && tag.tagName === 'script' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { - chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); - return; + if (scriptNonce) { + if (tag.tagName === 'script' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } + + if (tag.tagName === 'link' + && tag.attrs.find((attr) => attr.name === 'as' && attr.value === 'script') + && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem') + ) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } } - if (styleNonce && (tag.tagName === 'style' || tag.tagName === 'link') && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { - chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); - return; + if (styleNonce) { + if (tag.tagName === 'style' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } + + if (tag.tagName === 'link' + && tag.attrs.find((attr) => attr.name === 'rel' && attr.value === 'stylesheet') + && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem') + ) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } } chunks.push(getRawHTML(tag)); diff --git a/test/fixtures/code/super-test/static-nonce-fragment.html b/test/fixtures/code/super-test/static-nonce-fragment.html index c8f32793..5e153422 100644 --- a/test/fixtures/code/super-test/static-nonce-fragment.html +++ b/test/fixtures/code/super-test/static-nonce-fragment.html @@ -1,4 +1,5 @@ +
Nonce Test
diff --git a/test/fixtures/code/super-test/static-nonce-fragment.ref.html b/test/fixtures/code/super-test/static-nonce-fragment.ref.html index 21cbd4a5..57a89f54 100644 --- a/test/fixtures/code/super-test/static-nonce-fragment.ref.html +++ b/test/fixtures/code/super-test/static-nonce-fragment.ref.html @@ -1,4 +1,5 @@ +
Nonce Test
diff --git a/test/fixtures/code/super-test/static-nonce-header.html b/test/fixtures/code/super-test/static-nonce-header.html index dabff8fa..4547793e 100644 --- a/test/fixtures/code/super-test/static-nonce-header.html +++ b/test/fixtures/code/super-test/static-nonce-header.html @@ -14,6 +14,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-header.ref.html b/test/fixtures/code/super-test/static-nonce-header.ref.html index 5ee83800..e49e2f7b 100644 --- a/test/fixtures/code/super-test/static-nonce-header.ref.html +++ b/test/fixtures/code/super-test/static-nonce-header.ref.html @@ -14,6 +14,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.html b/test/fixtures/code/super-test/static-nonce-meta-different.html index b660b86f..078310f2 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-different.html +++ b/test/fixtures/code/super-test/static-nonce-meta-different.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html index b660b86f..078310f2 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html index 70cbe1a7..8696e713 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html +++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html index 7a8b1c19..cb53ef91 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta.html b/test/fixtures/code/super-test/static-nonce-meta.html index 4a3e2a06..f4e2be06 100644 --- a/test/fixtures/code/super-test/static-nonce-meta.html +++ b/test/fixtures/code/super-test/static-nonce-meta.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta.ref.html b/test/fixtures/code/super-test/static-nonce-meta.ref.html index 9fb09c12..4d84b41b 100644 --- a/test/fixtures/code/super-test/static-nonce-meta.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta.ref.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/content/nonce-headers-different.html b/test/fixtures/content/nonce-headers-different.html index ce02bb02..fbf4f295 100644 --- a/test/fixtures/content/nonce-headers-different.html +++ b/test/fixtures/content/nonce-headers-different.html @@ -14,6 +14,7 @@ + diff --git a/test/fixtures/content/nonce-headers-meta.html b/test/fixtures/content/nonce-headers-meta.html index 547995dc..499c9a46 100644 --- a/test/fixtures/content/nonce-headers-meta.html +++ b/test/fixtures/content/nonce-headers-meta.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/content/nonce-headers.html b/test/fixtures/content/nonce-headers.html index f941a05b..dcab792f 100644 --- a/test/fixtures/content/nonce-headers.html +++ b/test/fixtures/content/nonce-headers.html @@ -14,6 +14,7 @@ + diff --git a/test/fixtures/content/nonce-meta-different.html b/test/fixtures/content/nonce-meta-different.html index c5505253..bf234f8f 100644 --- a/test/fixtures/content/nonce-meta-different.html +++ b/test/fixtures/content/nonce-meta-different.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/content/nonce-meta-move-as-header.html b/test/fixtures/content/nonce-meta-move-as-header.html index 8733139a..b59d489b 100644 --- a/test/fixtures/content/nonce-meta-move-as-header.html +++ b/test/fixtures/content/nonce-meta-move-as-header.html @@ -14,6 +14,7 @@ + diff --git a/test/fixtures/content/nonce-meta.html b/test/fixtures/content/nonce-meta.html index f6d3289e..d00a53df 100644 --- a/test/fixtures/content/nonce-meta.html +++ b/test/fixtures/content/nonce-meta.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/content/nonce-script-only.html b/test/fixtures/content/nonce-script-only.html index 50b5d03c..e83613e8 100644 --- a/test/fixtures/content/nonce-script-only.html +++ b/test/fixtures/content/nonce-script-only.html @@ -14,6 +14,7 @@ + diff --git a/test/rendering.test.js b/test/rendering.test.js index 7ef9650c..1383ac7b 100644 --- a/test/rendering.test.js +++ b/test/rendering.test.js @@ -593,6 +593,7 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' @@ -617,7 +618,8 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' @@ -642,7 +644,8 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' @@ -660,6 +663,7 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' @@ -686,6 +690,7 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' @@ -710,7 +715,8 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' @@ -728,6 +734,7 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' @@ -752,7 +759,8 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n'