diff --git a/src/runtime/nitro/plugins/40-cspSsrNonce.ts b/src/runtime/nitro/plugins/40-cspSsrNonce.ts index 0f5b7fed..e8f57664 100644 --- a/src/runtime/nitro/plugins/40-cspSsrNonce.ts +++ b/src/runtime/nitro/plugins/40-cspSsrNonce.ts @@ -2,11 +2,9 @@ import { defineNitroPlugin } from 'nitropack/runtime' import { resolveSecurityRules } from '../context' import { generateRandomNonce } from '../../../utils/crypto' -const LINK_RE = /]*?>)/gi -const NONCE_RE = /nonce="[^"]+"/i -const SCRIPT_RE = /]*?>)/gi -const STYLE_RE = /]*?>)/gi -const QUOTE_MASK_RE = /"([^"\\]*(?:\\.[^"\\]*)*)"/g; +const NONCE_ELEM_RE = /<(link|script|style)\b([^>]*?>)/gi +const NONCE_RE = /\bnonce=__QUOTE_PLACEHOLDER_(\d+)__/i +const QUOTE_MASK_RE = /(? { quotes.push(match); - return `__QUOTE_PLACEHOLDER_${quotes.length - 1}__`; + return `__QUOTE_PLACEHOLDER_${quotes.length - 1}__` }); - // Add nonce to all link tags - maskedElement = maskedElement.replace(LINK_RE, (match, rest) => { + // Add nonce to all necessary tags + maskedElement = maskedElement.replace(NONCE_ELEM_RE, (match, elem, rest) => { if (NONCE_RE.test(rest)) { - return match.replace(NONCE_RE, `nonce="${nonce}"`); + return match.replace(NONCE_RE, `nonce="${nonce}"`) } - return ` { - return `