fix: add nonce to link preload tags (#59)

netlify · Nov 1, 2023 · c097ee0 · c097ee0
1 parent 7808378
commit c097ee0
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 7 deletions.
diff --git a/site/index.html b/site/index.html
@@ -2,11 +2,12 @@
 <html>
   <head>
     <title>Using CSP Nonces on Script Tags</title>
-    <style>
-      body {
-        font-family: sans-serif;
-      }
-    </style>
+    <link rel="stylesheet" href="/main.css" />
+    <link
+      rel="preload"
+      as="script"
+      href="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"
+    />
   </head>
   <body>
     <h1>Using CSP Nonces on Script Tags</h1>
@@ -40,7 +41,7 @@ <h1>Using CSP Nonces on Script Tags</h1>
           "ipt>" +
           "document.write('<div>❌ Script tag from <code>document.write</code> has executed!</div>');" +
           "</scr" +
-          "ipt>"
+          "ipt>",
       );
     </script>
     <script>

diff --git a/site/main.css b/site/main.css
@@ -0,0 +1,3 @@
+body {
+  font-family: sans-serif;
+}
diff --git a/src/__csp-nonce.ts b/src/__csp-nonce.ts
@@ -112,8 +112,9 @@ const handler = async (request: Request, context: Context) => {
     response.headers.set(header, value);
   }
 
+  const querySelectors = ["script", 'link[rel="preload"][as="script"]'];
   return new HTMLRewriter()
-    .on("script", {
+    .on(querySelectors.join(","), {
       element(element: HTMLElement) {
         element.setAttribute("nonce", nonce);
       },