Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSP: Provide a way to pass nonce to $.globalEval #4278

Closed
tandraschko opened this issue Jan 15, 2019 · 5 comments
Closed

CSP: Provide a way to pass nonce to $.globalEval #4278

tandraschko opened this issue Jan 15, 2019 · 5 comments
Assignees
Milestone

Comments

@tandraschko
Copy link

@tandraschko tandraschko commented Jan 15, 2019

In #3541 CSP support was introduced to not loose the nonce attribute of script tags when repacing/inserting DOM nodes.

Therefore DOMEval already has support for nonce.
As $.globalEval already uses DOMEval under the hood, it should be quite to allow to pass the nonce.

current scipt:

// Evaluates a script in a global context
globalEval: function( code ) { 
		DOMEval( code ); 
}

something like this should work:

// Evaluates a script in a global context 
globalEval: function( code, nonce ) { 
		DOMEval( code, null, { nonce: nonce }); 
}

Workaround:

        var script = document.createElement('script');
        script.setAttribute('nonce', 'myNonce');
        script.innerHTML = 'console.log("test")';
        document.head.appendChild(script);
@mgol mgol added this to the 3.4.0 milestone Jan 17, 2019
@mgol mgol self-assigned this Jan 17, 2019
@mgol mgol added the Core label Jan 17, 2019
mgol added a commit to mgol/jquery that referenced this issue Jan 17, 2019
@mgol
Copy link
Member

@mgol mgol commented Jan 17, 2019

Thanks for the report. PR: #4280.

mgol added a commit to mgol/jquery that referenced this issue Jan 17, 2019
mgol added a commit to mgol/jquery that referenced this issue Jan 18, 2019
@mgol mgol closed this in #4280 Jan 21, 2019
mgol added a commit that referenced this issue Jan 21, 2019
Fixes gh-4278
Closes gh-4280
Ref gh-3541
Ref gh-4269
@mgol
Copy link
Member

@mgol mgol commented Jan 21, 2019

@tandraschko The PR landed and it will be included in jQuery 3.4.0.

@tandraschko
Copy link
Author

@tandraschko tandraschko commented Jan 21, 2019

Great! Thank you!

@tandraschko
Copy link
Author

@tandraschko tandraschko commented Jan 21, 2019

When do you plan to release 3.4.0?

@mgol
Copy link
Member

@mgol mgol commented Jan 21, 2019

If we're lucky, somewhere between a week or two. But don't hold me to it, we're doing it in our free time so there may always be unexpected delays, sometimes even long ones.

@lock lock bot locked as resolved and limited conversation to collaborators Jul 20, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

2 participants