Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(@angular/build): add CSP nonce to script with src tags #27875

Merged
merged 1 commit into from
Jun 18, 2024
Merged

fix(@angular/build): add CSP nonce to script with src tags #27875

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions packages/angular/build/src/utils/index-file/nonce.ts
View file
Open in desktop
Copy link

@sagartalaviya91 sagartalaviya91 Jul 12, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I need this change on Angular version 16. Is there any way to do this fix in Version 16 by overriding inbuilt methods?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version 16 is in LTS phase and only received security fixes.

For all other fixes please update to the latest version.

Please see: https://angular.dev/reference/releases#actively-supported-versions

Copy link

@sagartalaviya91 sagartalaviya91 Jul 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alan-agius4 I tried same using latest version 18.1.0, but It is not adding nonce to script tags of main.js, polyfills.js etc. Could you please give the release date for this change, so that we can plan our migration accordingly? Stackblitz URL: https://stackblitz.com/edit/stackblitz-starters-wr9a9h?file=src%2Fapp%2Fapp.config.ts

Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,7 @@ export async function addNonce(html: string): Promise<string> {

rewriter.on('startTag', (tag) => {
if (
(tag.tagName === 'style' ||
(tag.tagName === 'script' && !tag.attrs.some((attr) => attr.name === 'src'))) &&
(tag.tagName === 'style' || tag.tagName === 'script') &&
!tag.attrs.some((attr) => attr.name === 'nonce')
) {
tag.attrs.push({ name: 'nonce', value: nonce });
Expand Down
12 changes: 6 additions & 6 deletions packages/angular/build/src/utils/index-file/nonce_spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,22 +74,22 @@ describe('addNonce', () => {
expect(result).toContain('<style nonce="{% nonce %}">.a {color: red;}</style>');
});

it('should to all inline script tags', async () => {
it('should to all script tags', async () => {
const result = await addNonce(`
<html>
<head>
</head>
<body>
<app ngCspNonce="{% nonce %}"></app>
<script>console.log('foo');</<script>
<script>console.log('foo');</script>
<script src="./main.js"></script>
<script>console.log('bar');</<script>
<script>console.log('bar');</script>
</body>
</html>
`);

expect(result).toContain(`<script nonce="{% nonce %}">console.log('foo');</<script>`);
expect(result).toContain('<script src="./main.js"></script>');
expect(result).toContain(`<script nonce="{% nonce %}">console.log('bar');</<script>`);
expect(result).toContain(`<script nonce="{% nonce %}">console.log('foo');</script>`);
expect(result).toContain('<script src="./main.js" nonce="{% nonce %}"></script>');
expect(result).toContain(`<script nonce="{% nonce %}">console.log('bar');</script>`);
});
});