Fix primefaces#2423/primefaces#2536: CSP allow setting inline nonce w…

…ith PrimeReact.inlineCssNonce
melloware · Dec 19, 2021 · ddd8f53 · ddd8f53
1 parent 124a57a
commit ddd8f53
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/components/lib/api/Api.d.ts b/components/lib/api/Api.d.ts
@@ -20,6 +20,7 @@ interface FilterMatchModeOptions {
 interface APIOptions {
     ripple?: boolean;
     inputStyle?: InputStyleType;
+    inlineCssNonce?: string;
     locale?: string;
     appendTo?: AppendToType;
     cssTransition?: boolean;

diff --git a/components/lib/api/PrimeReact.js b/components/lib/api/PrimeReact.js
@@ -14,6 +14,8 @@ export default class PrimeReact {
 
     static autoZIndex = true;
 
+    static inlineCssNonce = null;
+
     static zIndex = {
         modal: 1100,
         overlay: 1000,

diff --git a/components/lib/utils/DomHandler.js b/components/lib/utils/DomHandler.js
@@ -1,3 +1,5 @@
+import PrimeReact from '../api/Api';
+
 export default class DomHandler {
 
     static innerWidth(el) {
@@ -871,14 +873,20 @@ export default class DomHandler {
 
     /**
      * Anytime an inline style is created check environment variable 'process.env.REACT_APP_CSS_NONCE'
-     * to set a CSP NONCE.
+     * or global variable PrimeReact.inlineCssNonce to set a CSP NONCE.
      *
      * @see https://github.com/primefaces/primereact/issues/2423
      * @return HtmlStyleElement
      */
     static createInlineStyle() {
         let styleElement = document.createElement('style');
-        let nonce = process.env.REACT_APP_CSS_NONCE;
+        let nonce = '';
+        if (process) {
+            nonce = process.env.REACT_APP_CSS_NONCE;
+        }
+        if (!nonce) {
+            nonce = PrimeReact.inlineCssNonce;
+        }
         if (nonce) {
             styleElement.setAttribute('nonce', nonce);
         }