feat: add support for defining asset nonce

nails · Dec 17, 2024 · 7ea8e28 · 7ea8e28
1 parent d68eb85
commit 7ea8e28
Show file tree

Hide file tree

Showing 2 changed files with 67 additions and 11 deletions.
diff --git a/src/Common/Factory/Asset/CriticalCss.php b/src/Common/Factory/Asset/CriticalCss.php
@@ -125,7 +125,10 @@ protected function renderInline(): string
 
         return !empty($aOut)
             ? sprintf(
-                '<style type="text/css">%s</style>',
+                '<style type="text/css"%s>%s</style>',
+                $this->oAsset->getNonce()
+                    ? ' nonce="' . $this->oAsset->getNonce() . '"'
+                    : '',
                 implode('', $aOut)
             ) : '';
     }
@@ -163,8 +166,11 @@ protected function renderDeferredStylesheet(): string
         $sUrl = $this->getDeferredStylesheetUrl();
         return $sUrl
             ? sprintf(
-                '<link rel="stylesheet" as="style" href="%s" media="print" onload="this.media=\'all\'">',
-                $sUrl
+                '<link rel="stylesheet" as="style" href="%s" media="print" onload="this.media=\'all\'"%s />',
+                $sUrl,
+                $this->oAsset->getNonce()
+                    ? ' nonce="' . $this->oAsset->getNonce() . '"'
+                    : '',
             ) : '';
     }
 
@@ -180,8 +186,11 @@ protected function renderImmediateStylesheet(): string
         $sUrl = $this->getDeferredStylesheetUrl();
         return $sUrl
             ? sprintf(
-                '<link href="%s" rel="stylesheet" type="text/css"/>',
-                $sUrl
+                '<link href="%s" rel="stylesheet" type="text/css"%s/>',
+                $sUrl,
+                $this->oAsset->getNonce()
+                    ? ' nonce="' . $this->oAsset->getNonce() . '"'
+                    : '',
             ) : '';
     }
 }
diff --git a/src/Common/Service/Asset.php b/src/Common/Service/Asset.php
@@ -66,6 +66,13 @@ class Asset
      */
     protected $sCacheBuster;
 
+    /**
+     * A nonce to apply to script and style tags
+     *
+     * @var string|null
+     */
+    protected ?string $sNonce = null;
+
     /**
      * The base URL where assets are stored
      *
@@ -268,6 +275,19 @@ public function getBaseModuleUrl(): string
 
     // --------------------------------------------------------------------------
 
+    public function setNonce(?string $sNonce): self
+    {
+        $this->sNonce = $sNonce;
+        return $this;
+    }
+
+    public function getNonce(): ?string
+    {
+        return $this->sNonce;
+    }
+
+    // --------------------------------------------------------------------------
+
     /**
      * Unloads an asset
      *
@@ -752,7 +772,13 @@ public function output(string $sType = self::TYPE_ALL, bool $bOutput = true): ar
         //  Linked Stylesheets
         if (!empty($this->aCss) && ($sType === static::TYPE_CSS || $sType === static::TYPE_ALL)) {
             foreach ($this->aCss as $sAsset) {
-                $aOut[] = link_tag($sAsset);
+                $aOut[] = sprintf(
+                    '<link rel="stylesheet" href="%s" type="text/css"%s/>',
+                    $sAsset,
+                    $this->getNonce()
+                        ? ' nonce="' . $this->getNonce() . '"'
+                        : ''
+                );
             }
         }
 
@@ -763,12 +789,15 @@ public function output(string $sType = self::TYPE_ALL, bool $bOutput = true): ar
             foreach ($this->aJs as $aAsset) {
                 [$sAsset, $bAsync, $bDefer, $bModule] = $aAsset;
                 $aOut[] = sprintf(
-                    '<script src="%s"%s%s%s></script>',
+                    '<script src="%s"%s%s%s%s></script>',
                     $sAsset,
                     $bAsync ? 'async ' : '',
                     $bDefer ? 'defer ' : '',
                     isset($bModule)
                         ? ($bModule ? 'type="module"' : 'nomodule') . ' '
+                        : '',
+                    $this->getNonce()
+                        ? ' nonce="' . $this->getNonce() . '"'
                         : ''
                 );
             }
@@ -778,12 +807,15 @@ public function output(string $sType = self::TYPE_ALL, bool $bOutput = true): ar
             foreach ($this->aJsHeader as $aAsset) {
                 [$sAsset, $bAsync, $bDefer, $bModule] = $aAsset;
                 $aOut[] = sprintf(
-                    '<script src="%s"%s%s%s></script>',
+                    '<script src="%s"%s%s%s%s></script>',
                     $sAsset,
                     $bAsync ? ' async' : '',
                     $bDefer ? ' defer' : '',
                     isset($bModule)
                         ? ' ' . ($bModule ? 'type="module"' : 'nomodule')
+                        : '',
+                    $this->getNonce()
+                        ? ' nonce="' . $this->getNonce() . '"'
                         : ''
                 );
             }
@@ -794,7 +826,12 @@ public function output(string $sType = self::TYPE_ALL, bool $bOutput = true): ar
         //  Inline CSS
         if (!empty($this->aCssInline) && ($sType === static::TYPE_CSS_INLINE || $sType === static::TYPE_ALL)) {
 
-            $aOut[] = '<style type="text/css">';
+            $aOut[] = sprintf(
+                '<style type="text/css"%s>',
+                $this->getNonce()
+                    ? 'nonce="' . $this->getNonce() . '"'
+                    : ''
+            );
             foreach ($this->aCssInline as $sAsset) {
                 if ($sAsset instanceof \Closure) {
                     $aOut[] = $sAsset();
@@ -809,7 +846,12 @@ public function output(string $sType = self::TYPE_ALL, bool $bOutput = true): ar
 
         //  Inline JS (Header)
         if (!empty($this->aJsInlineHeader) && ($sType === static::TYPE_JS_INLINE_HEADER || $sType === static::TYPE_ALL)) {
-            $aOut[] = '<script>';
+            $aOut[] = sprintf(
+                '<script%s>',
+                $this->getNonce()
+                    ? ' nonce="' . $this->getNonce() . '"'
+                    : ''
+            );
             foreach ($this->aJsInlineHeader as $sAsset) {
                 if ($sAsset instanceof \Closure) {
                     $aOut[] = $sAsset();
@@ -824,7 +866,12 @@ public function output(string $sType = self::TYPE_ALL, bool $bOutput = true): ar
 
         //  Inline JS (Footer)
         if (!empty($this->aJsInlineFooter) && ($sType === static::TYPE_JS_INLINE_FOOTER || $sType === static::TYPE_ALL)) {
-            $aOut[] = '<script>';
+            $aOut[] = sprintf(
+                '<script%s>',
+                $this->getNonce()
+                    ? ' nonce="' . $this->getNonce() . '"'
+                    : ''
+            );
             foreach ($this->aJsInlineFooter as $sAsset) {
                 if ($sAsset instanceof \Closure) {
                     $aOut[] = $sAsset();