fix: ensure nonce is present on parsed style tags

stampedai · Dec 13, 2023 · bac8a73 · bac8a73
1 parent 773ef75
commit bac8a73
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/dist/turbo.es2017-esm.js b/dist/turbo.es2017-esm.js
@@ -364,6 +364,11 @@ function parseHTMLDocument(html = "") {
         styleMap[uniqueKey] = style;
         return `<${tag}${otherAttrs} data-style-attribute="${uniqueKey}"`;
     });
+    html = html.replace(/<style([^>]*)>/g, (match, otherAttrs) => {
+        const nonce = getMetaContent("csp-nonce");
+        otherAttrs = otherAttrs.replace(/nonce=""/g, "");
+        return nonce ? `<style${otherAttrs} nonce="${nonce}">` : match;
+    });
     const doc = new DOMParser().parseFromString(html, "text/html");
     Object.keys(styleMap).forEach(uniqueKey => {
         const elements = doc.querySelectorAll(`[data-style-attribute="${uniqueKey}"]`);

diff --git a/dist/turbo.es2017-umd.js b/dist/turbo.es2017-umd.js
@@ -370,6 +370,11 @@ Copyright © 2023 37signals LLC
             styleMap[uniqueKey] = style;
             return `<${tag}${otherAttrs} data-style-attribute="${uniqueKey}"`;
         });
+        html = html.replace(/<style([^>]*)>/g, (match, otherAttrs) => {
+            const nonce = getMetaContent("csp-nonce");
+            otherAttrs = otherAttrs.replace(/nonce=""/g, "");
+            return nonce ? `<style${otherAttrs} nonce="${nonce}">` : match;
+        });
         const doc = new DOMParser().parseFromString(html, "text/html");
         Object.keys(styleMap).forEach(uniqueKey => {
             const elements = doc.querySelectorAll(`[data-style-attribute="${uniqueKey}"]`);

diff --git a/src/util.ts b/src/util.ts
@@ -77,6 +77,12 @@ export function parseHTMLDocument(html: string = ""): Document {
     return `<${tag}${otherAttrs} data-style-attribute="${uniqueKey}"`;
   });
 
+  html = html.replace(/<style([^>]*)>/g, (match, otherAttrs) => {
+    const nonce = getMetaContent("csp-nonce");
+    otherAttrs = otherAttrs.replace(/nonce=""/g, "");
+    return nonce ? `<style${otherAttrs} nonce="${nonce}">` : match;
+});
+
   const doc: Document = new DOMParser().parseFromString(html, "text/html");
 
   // Apply styles and remove data-style-attribute