New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSP: Provide a way to pass nonce to $.globalEval #4278

Closed
tandraschko opened this Issue Jan 15, 2019 · 5 comments

Comments

Projects
None yet
2 participants
@tandraschko
Copy link

tandraschko commented Jan 15, 2019

In #3541 CSP support was introduced to not loose the nonce attribute of script tags when repacing/inserting DOM nodes.

Therefore DOMEval already has support for nonce.
As $.globalEval already uses DOMEval under the hood, it should be quite to allow to pass the nonce.

current scipt:

// Evaluates a script in a global context
globalEval: function( code ) { 
		DOMEval( code ); 
}

something like this should work:

// Evaluates a script in a global context 
globalEval: function( code, nonce ) { 
		DOMEval( code, null, { nonce: nonce }); 
}

Workaround:

        var script = document.createElement('script');
        script.setAttribute('nonce', 'myNonce');
        script.innerHTML = 'console.log("test")';
        document.head.appendChild(script);

@mgol mgol added this to the 3.4.0 milestone Jan 17, 2019

@mgol mgol self-assigned this Jan 17, 2019

@mgol mgol added the Core label Jan 17, 2019

mgol added a commit to mgol/jquery that referenced this issue Jan 17, 2019

@mgol

This comment has been minimized.

Copy link
Member

mgol commented Jan 17, 2019

Thanks for the report. PR: #4280.

mgol added a commit to mgol/jquery that referenced this issue Jan 17, 2019

mgol added a commit to mgol/jquery that referenced this issue Jan 18, 2019

@mgol mgol closed this in #4280 Jan 21, 2019

mgol added a commit that referenced this issue Jan 21, 2019

@mgol

This comment has been minimized.

Copy link
Member

mgol commented Jan 21, 2019

@tandraschko The PR landed and it will be included in jQuery 3.4.0.

@tandraschko

This comment has been minimized.

Copy link
Author

tandraschko commented Jan 21, 2019

Great! Thank you!

@tandraschko

This comment has been minimized.

Copy link
Author

tandraschko commented Jan 21, 2019

When do you plan to release 3.4.0?

@mgol

This comment has been minimized.

Copy link
Member

mgol commented Jan 21, 2019

If we're lucky, somewhere between a week or two. But don't hold me to it, we're doing it in our free time so there may always be unexpected delays, sometimes even long ones.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment