Add nonce to <script> elements (#1464)

barryvdh · Sep 19, 2023 · 8a3bab7 · 8a3bab7
1 parent 88aef02
commit 8a3bab7
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/src/JavascriptRenderer.php b/src/JavascriptRenderer.php
@@ -63,14 +63,20 @@ public function renderHead()
         $cssRoute = preg_replace('/\Ahttps?:/', '', $cssRoute);
         $jsRoute  = preg_replace('/\Ahttps?:/', '', $jsRoute);
 
+        $nonce = $this->getNonceAttribute();
+
         $html  = "<link rel='stylesheet' type='text/css' property='stylesheet' href='{$cssRoute}' data-turbolinks-eval='false' data-turbo-eval='false'>";
-        $html .= "<script src='{$jsRoute}' data-turbolinks-eval='false' data-turbo-eval='false'></script>";
+        $html .= "<script{$nonce} src='{$jsRoute}' data-turbolinks-eval='false' data-turbo-eval='false'></script>";
 
         if ($this->isJqueryNoConflictEnabled()) {
-            $html .= '<script data-turbo-eval="false">jQuery.noConflict(true);</script>' . "\n";
+            $html .= "<script{$nonce} data-turbo-eval='false'>jQuery.noConflict(true);</script>" . "\n";
         }
 
-        $html .= $this->getInlineHtml();
+        $inlineHtml = $this->getInlineHtml();
+        if ($nonce != '') {
+            $inlineHtml = preg_replace("/<script>/", "<script{$nonce}>", $inlineHtml);
+        }
+        $html .= $inlineHtml;
 
 
         return $html;