Use csp()->getNonce() instead of cspNonce() - VUFIND-1510

module/VuFind/src/VuFind/Security/NonceGenerator.php

@@ -48,7 +48,7 @@ class NonceGenerator
      *
      * @var string
      */
-    protected $nonce;
+    protected string $nonce = '';
 
     /**
      * Generates a random nonce parameter.

module/VuFind/src/VuFind/View/Helper/Root/Csp.php

@@ -42,29 +42,22 @@
  */
 class Csp extends \Laminas\View\Helper\AbstractHelper
 {
-    /**
-     * Response object
-     *
-     * @var Response
-     */
-    protected $response;
-
     /**
      * Constructor
      *
-     * @param Response $response HTTP Response, if any
+     * @param ?Response $response HTTP Response, if any
+     * @param string    $nonce    CSP nonce
      */
-    public function __construct(?Response $response)
+    public function __construct(protected ?Response $response, protected string $nonce)
     {
-        $this->response = $response;
     }
 
     /**
      * Disable Content Security Policy by removing the headers
      *
      * @return void
      */
-    public function disablePolicy()
+    public function disablePolicy(): void
     {
         if (null === $this->response) {
             return;
@@ -86,4 +79,16 @@ public function disablePolicy()
             }
         }
     }
+
+    /**
+     * Return the current nonce
+     *
+     * Result is a base64 encoded string that does not need escaping.
+     *
+     * @return string
+     */
+    public function getNonce(): string
+    {
+        return $this->nonce;
+    }
 }

module/VuFind/src/VuFind/View/Helper/Root/CspFactory.php

@@ -68,6 +68,7 @@ public function __invoke(
         if (!empty($options)) {
             throw new \Exception('Unexpected options sent to factory.');
         }
-        return new $requestedName($container->get('Response'));
+        $nonceGenerator = $container->get(\VuFind\Security\NonceGenerator::class);
+        return new $requestedName($container->get('Response'), $nonceGenerator->getNonce());
     }
 }

module/VuFind/src/VuFind/View/Helper/Root/CspNonce.php

@@ -62,6 +62,8 @@ public function __construct($nonce)
      *
      * Result is a base64 encoded string that does not need escaping.
      *
+     * @deprecated Use Csp::getNonce() instead
+     *
      * @return string
      */
     public function __invoke()

module/VuFind/tests/unit-tests/src/VuFindTest/View/Helper/Root/CspTest.php

@@ -77,7 +77,7 @@ public function testDisablePolicyWithCspEnabled(): void
         $added = $headers->get('Content-Security-Policy');
         $this->assertEquals(1, $added->count());
 
-        $csp = new \VuFind\View\Helper\Root\Csp($response);
+        $csp = new \VuFind\View\Helper\Root\Csp($response, $nonceGenerator->getNonce());
         $csp->disablePolicy();
         $this->assertFalse($headers->get('Content-Security-Policy'));
     }
@@ -119,7 +119,7 @@ public function testDisablePolicyWithCspReportOnly(): void
         $added = $headers->get('Content-Security-Policy-Report-Only');
         $this->assertFalse(is_iterable($added));
 
-        $csp = new \VuFind\View\Helper\Root\Csp($response);
+        $csp = new \VuFind\View\Helper\Root\Csp($response, $nonceGenerator->getNonce());
         $csp->disablePolicy();
         $this->assertFalse($headers->get('Content-Security-Policy-Report-Only'));
     }
@@ -155,7 +155,7 @@ public function testDisablePolicyWithCspDisabled(): void
         $header = $cspHeaderGenerator->getHeader();
         $this->assertNull($header);
 
-        $csp = new \VuFind\View\Helper\Root\Csp($response);
+        $csp = new \VuFind\View\Helper\Root\Csp($response, $nonceGenerator->getNonce());
         $csp->disablePolicy();
     }
 }

themes/bootstrap3/templates/layout/layout.phtml

@@ -101,7 +101,7 @@
       $root = rtrim($this->url('home'), '/');
       $translations = !isset($this->renderingError) ? $this->render('js-translations.phtml') : '{}';
       $dsb = DEFAULT_SEARCH_BACKEND;
-      $cspNonce = $this->cspNonce();
+      $cspNonce = $this->csp()->getNonce();
       $searchId = json_encode($this->layout()->searchId);
       $appendScripts[] = <<<JS
           VuFind.path = '{$root}';

themes/root/theme.config.php

@@ -22,7 +22,6 @@
             'VuFind\View\Helper\Root\ContentBlock' => 'Laminas\ServiceManager\Factory\InvokableFactory',
             'VuFind\View\Helper\Root\Context' => 'Laminas\ServiceManager\Factory\InvokableFactory',
             'VuFind\View\Helper\Root\Csp' => 'VuFind\View\Helper\Root\CspFactory',
-            'VuFind\View\Helper\Root\CspNonce' => 'VuFind\View\Helper\Root\CspNonceFactory',
             'VuFind\View\Helper\Root\CurrentPath' => 'Laminas\ServiceManager\Factory\InvokableFactory',
             'VuFind\View\Helper\Root\DateTime' => 'VuFind\View\Helper\Root\DateTimeFactory',
             'VuFind\View\Helper\Root\DisplayLanguageOption' => 'VuFind\View\Helper\Root\DisplayLanguageOptionFactory',