diff options
| author | George Claghorn <george.claghorn@gmail.com> | 2019-03-08 15:25:24 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-03-08 15:25:24 -0500 |
| commit | ceeef26fd43ab6daff19042db73abd49d9ed5d61 (patch) | |
| tree | b888dae800b44adb12c8592f2bbc7048c9c4ecc6 /actionview/app/assets | |
| parent | cc7483d3f081086fe4fcb8f1e2f511e50c929cc5 (diff) | |
| download | rails-ceeef26fd43ab6daff19042db73abd49d9ed5d61.tar.gz rails-ceeef26fd43ab6daff19042db73abd49d9ed5d61.tar.bz2 rails-ceeef26fd43ab6daff19042db73abd49d9ed5d61.zip | |
Read the CSP nonce on page load
Turbolinks replaces the CSP nonce <meta> tag on page change, but inline scripts inserted by UJS need the nonce from the initial page load. In general, it doesn't matter to UJS if the nonce changes after the page loads: only the initial value is relevant.
Diffstat (limited to 'actionview/app/assets')
| -rw-r--r-- | actionview/app/assets/javascripts/rails-ujs/start.coffee | 2 | ||||
| -rw-r--r-- | actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee | 12 |
2 files changed, 10 insertions, 4 deletions
diff --git a/actionview/app/assets/javascripts/rails-ujs/start.coffee b/actionview/app/assets/javascripts/rails-ujs/start.coffee index 5c1214df59..0347058195 100644 --- a/actionview/app/assets/javascripts/rails-ujs/start.coffee +++ b/actionview/app/assets/javascripts/rails-ujs/start.coffee @@ -2,6 +2,7 @@ fire, delegate getData, $ refreshCSRFTokens, CSRFProtection + loadCSPNonce enableElement, disableElement, handleDisabledElement handleConfirm, preventInsignificantClick handleRemote, formSubmitButtonClick, @@ -67,6 +68,7 @@ Rails.start = -> delegate document, Rails.formInputClickSelector, 'click', formSubmitButtonClick document.addEventListener('DOMContentLoaded', refreshCSRFTokens) + document.addEventListener('DOMContentLoaded', loadCSPNonce) window._rails_loaded = true if window.Rails is Rails and fire(document, 'rails:attachBindings') diff --git a/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee b/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee index 8d2d6ce447..a33f531375 100644 --- a/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee +++ b/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee @@ -1,4 +1,8 @@ -# Content-Security-Policy nonce for inline scripts -cspNonce = Rails.cspNonce = -> - meta = document.querySelector('meta[name=csp-nonce]') - meta and meta.content +nonce = null + +Rails.loadCSPNonce = -> + nonce = document.querySelector("meta[name=csp-nonce]")?.content + +# Returns the Content-Security-Policy nonce for inline scripts. +Rails.cspNonce = -> + nonce ? Rails.loadCSPNonce() |