Skip to content

refactor(cspSsrNonce): refactor html injection #738

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GalacticHypernova wants to merge 10 commits into
base: main
Choose a base branch
from
Open

refactor(cspSsrNonce): refactor html injection #738

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
270e61d
refactor(cspSSrNonce): scope-aware masking and single pass
GalacticHypernova Jul 18, 2026
3744ae9
fix(cspSsrNonce): word boundary
GalacticHypernova Jul 18, 2026
1d34006
refactor(cspSsrNonce): look-behind assertion property based lookup
GalacticHypernova Jul 18, 2026
13cabbf
style(cspSsrNonce): remove semicolons
GalacticHypernova Jul 18, 2026
f7ff42f
fix(cspSsrNonce): mask content, preserve quotes
GalacticHypernova Jul 18, 2026
3f75b5a
fix(cspSsrNonce): replace matched content
GalacticHypernova Jul 18, 2026
894ced5
fix(cspSsrNonce): revert to whole-match
GalacticHypernova Jul 18, 2026
908a9ea
fix(cspSsrNonce): capture preceding character and preserve quotes
GalacticHypernova Jul 18, 2026
8bf9964
fix(cspSsrNonce): whole-match with adjusted nonce
GalacticHypernova Jul 18, 2026
a0ff68c
perf(cspSsrNonce): simplify regex
GalacticHypernova Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 9 additions & 19 deletions src/runtime/nitro/plugins/40-cspSsrNonce.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,9 @@ import { defineNitroPlugin } from 'nitropack/runtime'
import { resolveSecurityRules } from '../context'
import { generateRandomNonce } from '../../../utils/crypto'

const LINK_RE = /<link\b([^>]*?>)/gi
const NONCE_RE = /nonce="[^"]+"/i
const SCRIPT_RE = /<script\b([^>]*?>)/gi
const STYLE_RE = /<style\b([^>]*?>)/gi
const QUOTE_MASK_RE = /"([^"\\]*(?:\\.[^"\\]*)*)"/g;
const NONCE_ELEM_RE = /<(link|script|style)\b([^>]*?>)/gi
const NONCE_RE = /\bnonce=__QUOTE_PLACEHOLDER_(\d+)__/i
const QUOTE_MASK_RE = /(?<!\\)"[^"\\]*(?:\\.[^"\\]*)*"/g
const QUOTE_RESTORE_RE = /__QUOTE_PLACEHOLDER_(\d+)__/g

function injectNonceToTags(element: string, nonce: string) {
Expand All @@ -19,27 +17,19 @@ function injectNonceToTags(element: string, nonce: string) {
// Mask attributes to avoid manipulating stringified elements
let maskedElement = element.replace(QUOTE_MASK_RE, (match) => {
quotes.push(match);
return `__QUOTE_PLACEHOLDER_${quotes.length - 1}__`;
return `__QUOTE_PLACEHOLDER_${quotes.length - 1}__`
});
// Add nonce to all link tags
maskedElement = maskedElement.replace(LINK_RE, (match, rest) => {
// Add nonce to all necessary tags
maskedElement = maskedElement.replace(NONCE_ELEM_RE, (match, elem, rest) => {
if (NONCE_RE.test(rest)) {
return match.replace(NONCE_RE, `nonce="${nonce}"`);
return match.replace(NONCE_RE, `nonce="${nonce}"`)
}
return `<link nonce="${nonce}"` + rest
})
// Add nonce to all script tags
maskedElement = maskedElement.replace(SCRIPT_RE, (match, rest) => {
return `<script nonce="${nonce}"` + rest
})
// Add nonce to all style tags
maskedElement = maskedElement.replace(STYLE_RE, (match, rest) => {
return `<style nonce="${nonce}"` + rest
return `<${elem} nonce="${nonce}"` + rest
})

// Restore the original quoted content.
const restoredHtml = maskedElement.replace(QUOTE_RESTORE_RE, (match, index) => {
return quotes[parseInt(index, 10)];
return quotes[parseInt(index, 10)]
});

return restoredHtml;
Expand Down
Loading