From 0751c27f750515ada075144729a78b52776eaf7f Mon Sep 17 00:00:00 2001 From: Andrei Tuicu Date: Mon, 31 Mar 2025 12:37:26 +0200 Subject: [PATCH 1/2] feat: Add script nonce to --- src/steps/csp.js | 44 +++++++++++++++---- .../super-test/static-nonce-fragment.html | 1 + .../super-test/static-nonce-fragment.ref.html | 1 + .../code/super-test/static-nonce-header.html | 1 + .../super-test/static-nonce-header.ref.html | 1 + .../static-nonce-meta-different.html | 1 + .../static-nonce-meta-different.ref.html | 1 + .../static-nonce-meta-move-as-header.html | 1 + .../static-nonce-meta-move-as-header.ref.html | 1 + .../code/super-test/static-nonce-meta.html | 1 + .../super-test/static-nonce-meta.ref.html | 1 + .../content/nonce-headers-different.html | 1 + test/fixtures/content/nonce-headers-meta.html | 1 + test/fixtures/content/nonce-headers.html | 1 + .../content/nonce-meta-different.html | 1 + .../content/nonce-meta-move-as-header.html | 1 + test/fixtures/content/nonce-meta.html | 1 + test/fixtures/content/nonce-script-only.html | 1 + test/rendering.test.js | 8 ++++ 19 files changed, 60 insertions(+), 9 deletions(-) diff --git a/src/steps/csp.js b/src/steps/csp.js index aeac9bb2..ad91a176 100644 --- a/src/steps/csp.js +++ b/src/steps/csp.js @@ -111,9 +111,15 @@ function createAndApplyNonceOnAST(res, tree, metaCSP, headerCSP, headerCSPRO) { } visit(tree, (node) => { - if (scriptNonce && node.tagName === 'script' && node.properties?.nonce === 'aem') { - node.properties.nonce = nonce; - return; + if (scriptNonce) { + if (node.tagName === 'script' && node.properties?.nonce === 'aem') { + node.properties.nonce = nonce; + return; + } + if (node.tagName === 'link' && node.properties?.as === 'script' && node.properties?.nonce === 'aem') { + node.properties.nonce = nonce; + return; + } } if (styleNonce @@ -222,14 +228,34 @@ export function contentSecurityPolicyOnCode(state, res) { } } - if (scriptNonce && tag.tagName === 'script' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { - chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); - return; + if (scriptNonce) { + if (tag.tagName === 'script' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } + + if (tag.tagName === 'link' + && tag.attrs.find((attr) => attr.name === 'as' && attr.value === 'script') + && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem') + ) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } } - if (styleNonce && (tag.tagName === 'style' || tag.tagName === 'link') && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { - chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); - return; + if (styleNonce) { + if (tag.tagName === 'style' && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem')) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } + + if (tag.tagName === 'link' + && tag.attrs.find((attr) => attr.name === 'rel' && attr.value === 'stylesheet') + && tag.attrs.find((attr) => attr.name === 'nonce' && attr.value === 'aem') + ) { + chunks.push(getRawHTML(tag).replace(/nonce="aem"/i, `nonce="${nonce}"`)); + return; + } } chunks.push(getRawHTML(tag)); diff --git a/test/fixtures/code/super-test/static-nonce-fragment.html b/test/fixtures/code/super-test/static-nonce-fragment.html index c8f32793..5e153422 100644 --- a/test/fixtures/code/super-test/static-nonce-fragment.html +++ b/test/fixtures/code/super-test/static-nonce-fragment.html @@ -1,4 +1,5 @@ +
Nonce Test
diff --git a/test/fixtures/code/super-test/static-nonce-fragment.ref.html b/test/fixtures/code/super-test/static-nonce-fragment.ref.html index 21cbd4a5..57a89f54 100644 --- a/test/fixtures/code/super-test/static-nonce-fragment.ref.html +++ b/test/fixtures/code/super-test/static-nonce-fragment.ref.html @@ -1,4 +1,5 @@ +
Nonce Test
diff --git a/test/fixtures/code/super-test/static-nonce-header.html b/test/fixtures/code/super-test/static-nonce-header.html index dabff8fa..38896a51 100644 --- a/test/fixtures/code/super-test/static-nonce-header.html +++ b/test/fixtures/code/super-test/static-nonce-header.html @@ -18,6 +18,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-header.ref.html b/test/fixtures/code/super-test/static-nonce-header.ref.html index 5ee83800..bcbd70c5 100644 --- a/test/fixtures/code/super-test/static-nonce-header.ref.html +++ b/test/fixtures/code/super-test/static-nonce-header.ref.html @@ -18,6 +18,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.html b/test/fixtures/code/super-test/static-nonce-meta-different.html index b660b86f..8e7ba5d0 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-different.html +++ b/test/fixtures/code/super-test/static-nonce-meta-different.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html index b660b86f..8e7ba5d0 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html index 70cbe1a7..f6e3411d 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html +++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html index 7a8b1c19..8a297a46 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta.html b/test/fixtures/code/super-test/static-nonce-meta.html index 4a3e2a06..f4e2be06 100644 --- a/test/fixtures/code/super-test/static-nonce-meta.html +++ b/test/fixtures/code/super-test/static-nonce-meta.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/code/super-test/static-nonce-meta.ref.html b/test/fixtures/code/super-test/static-nonce-meta.ref.html index 9fb09c12..4d84b41b 100644 --- a/test/fixtures/code/super-test/static-nonce-meta.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta.ref.html @@ -15,6 +15,7 @@ + diff --git a/test/fixtures/content/nonce-headers-different.html b/test/fixtures/content/nonce-headers-different.html index ce02bb02..c8456038 100644 --- a/test/fixtures/content/nonce-headers-different.html +++ b/test/fixtures/content/nonce-headers-different.html @@ -18,6 +18,7 @@ + diff --git a/test/fixtures/content/nonce-headers-meta.html b/test/fixtures/content/nonce-headers-meta.html index 547995dc..659c84a9 100644 --- a/test/fixtures/content/nonce-headers-meta.html +++ b/test/fixtures/content/nonce-headers-meta.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/content/nonce-headers.html b/test/fixtures/content/nonce-headers.html index f941a05b..fb7a3bae 100644 --- a/test/fixtures/content/nonce-headers.html +++ b/test/fixtures/content/nonce-headers.html @@ -18,6 +18,7 @@ + diff --git a/test/fixtures/content/nonce-meta-different.html b/test/fixtures/content/nonce-meta-different.html index c5505253..d2f44420 100644 --- a/test/fixtures/content/nonce-meta-different.html +++ b/test/fixtures/content/nonce-meta-different.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/content/nonce-meta-move-as-header.html b/test/fixtures/content/nonce-meta-move-as-header.html index 8733139a..d783d3d0 100644 --- a/test/fixtures/content/nonce-meta-move-as-header.html +++ b/test/fixtures/content/nonce-meta-move-as-header.html @@ -18,6 +18,7 @@ + diff --git a/test/fixtures/content/nonce-meta.html b/test/fixtures/content/nonce-meta.html index f6d3289e..07c310dc 100644 --- a/test/fixtures/content/nonce-meta.html +++ b/test/fixtures/content/nonce-meta.html @@ -19,6 +19,7 @@ + diff --git a/test/fixtures/content/nonce-script-only.html b/test/fixtures/content/nonce-script-only.html index 50b5d03c..ac4ed600 100644 --- a/test/fixtures/content/nonce-script-only.html +++ b/test/fixtures/content/nonce-script-only.html @@ -18,6 +18,7 @@ + diff --git a/test/rendering.test.js b/test/rendering.test.js index 7ef9650c..0afe8af1 100644 --- a/test/rendering.test.js +++ b/test/rendering.test.js @@ -597,6 +597,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -621,6 +622,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -646,6 +648,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -664,6 +667,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -690,6 +694,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -714,6 +719,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -732,6 +738,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; @@ -756,6 +763,7 @@ describe('Rendering', () => { + '\n' + '\n' + '\n' + + '\n' + '', }, }; From c1a7badbb83176d71a4063314726d130b7fa0ce9 Mon Sep 17 00:00:00 2001 From: Andrei Tuicu Date: Mon, 31 Mar 2025 17:49:05 +0200 Subject: [PATCH 2/2] feat: Add script nonce to --- .../code/super-test/static-nonce-header.html | 2 +- .../super-test/static-nonce-header.ref.html | 2 +- .../static-nonce-meta-different.html | 2 +- .../static-nonce-meta-different.ref.html | 2 +- .../static-nonce-meta-move-as-header.html | 2 +- .../static-nonce-meta-move-as-header.ref.html | 2 +- .../content/nonce-headers-different.html | 2 +- test/fixtures/content/nonce-headers-meta.html | 2 +- test/fixtures/content/nonce-headers.html | 2 +- .../content/nonce-meta-different.html | 2 +- .../content/nonce-meta-move-as-header.html | 2 +- test/fixtures/content/nonce-meta.html | 2 +- test/fixtures/content/nonce-script-only.html | 2 +- test/rendering.test.js | 24 +++++++++---------- 14 files changed, 25 insertions(+), 25 deletions(-) diff --git a/test/fixtures/code/super-test/static-nonce-header.html b/test/fixtures/code/super-test/static-nonce-header.html index 38896a51..4547793e 100644 --- a/test/fixtures/code/super-test/static-nonce-header.html +++ b/test/fixtures/code/super-test/static-nonce-header.html @@ -14,11 +14,11 @@ + - diff --git a/test/fixtures/code/super-test/static-nonce-header.ref.html b/test/fixtures/code/super-test/static-nonce-header.ref.html index bcbd70c5..e49e2f7b 100644 --- a/test/fixtures/code/super-test/static-nonce-header.ref.html +++ b/test/fixtures/code/super-test/static-nonce-header.ref.html @@ -14,11 +14,11 @@ + - diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.html b/test/fixtures/code/super-test/static-nonce-meta-different.html index 8e7ba5d0..078310f2 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-different.html +++ b/test/fixtures/code/super-test/static-nonce-meta-different.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html index 8e7ba5d0..078310f2 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-different.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta-different.ref.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html index f6e3411d..8696e713 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html +++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html index 8a297a46..cb53ef91 100644 --- a/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html +++ b/test/fixtures/code/super-test/static-nonce-meta-move-as-header.ref.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/content/nonce-headers-different.html b/test/fixtures/content/nonce-headers-different.html index c8456038..fbf4f295 100644 --- a/test/fixtures/content/nonce-headers-different.html +++ b/test/fixtures/content/nonce-headers-different.html @@ -14,11 +14,11 @@ + - diff --git a/test/fixtures/content/nonce-headers-meta.html b/test/fixtures/content/nonce-headers-meta.html index 659c84a9..499c9a46 100644 --- a/test/fixtures/content/nonce-headers-meta.html +++ b/test/fixtures/content/nonce-headers-meta.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/content/nonce-headers.html b/test/fixtures/content/nonce-headers.html index fb7a3bae..dcab792f 100644 --- a/test/fixtures/content/nonce-headers.html +++ b/test/fixtures/content/nonce-headers.html @@ -14,11 +14,11 @@ + - diff --git a/test/fixtures/content/nonce-meta-different.html b/test/fixtures/content/nonce-meta-different.html index d2f44420..bf234f8f 100644 --- a/test/fixtures/content/nonce-meta-different.html +++ b/test/fixtures/content/nonce-meta-different.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/content/nonce-meta-move-as-header.html b/test/fixtures/content/nonce-meta-move-as-header.html index d783d3d0..b59d489b 100644 --- a/test/fixtures/content/nonce-meta-move-as-header.html +++ b/test/fixtures/content/nonce-meta-move-as-header.html @@ -14,11 +14,11 @@ + - diff --git a/test/fixtures/content/nonce-meta.html b/test/fixtures/content/nonce-meta.html index 07c310dc..d00a53df 100644 --- a/test/fixtures/content/nonce-meta.html +++ b/test/fixtures/content/nonce-meta.html @@ -15,11 +15,11 @@ + - diff --git a/test/fixtures/content/nonce-script-only.html b/test/fixtures/content/nonce-script-only.html index ac4ed600..e83613e8 100644 --- a/test/fixtures/content/nonce-script-only.html +++ b/test/fixtures/content/nonce-script-only.html @@ -14,11 +14,11 @@ + - diff --git a/test/rendering.test.js b/test/rendering.test.js index 0afe8af1..1383ac7b 100644 --- a/test/rendering.test.js +++ b/test/rendering.test.js @@ -593,11 +593,11 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -618,11 +618,11 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -644,11 +644,11 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -663,11 +663,11 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -690,11 +690,11 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -715,11 +715,11 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -734,11 +734,11 @@ describe('Rendering', () => { head: { // eslint-disable-next-line quotes html: `\n` + + '\n' + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, }; @@ -759,11 +759,11 @@ describe('Rendering', () => { ], }, head: { - html: '\n' + html: '\n' + + '\n' + '\n' + '\n' + '\n' - + '\n' + '', }, };