Skip to content

Commit ba57531

Browse files
committed
Add missing nonced_stylesheet_pack_tag
Equivalents were added in 1e81a0a. This also fixes a bug preventing passing any arguments to these tags. Tests were updated with a sample to reflect this.
1 parent ec4b50e commit ba57531

3 files changed

Lines changed: 20 additions & 6 deletions

File tree

docs/per_action_configuration.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ body {
7272
<%= nonced_javascript_pack_tag "pack.js" %>
7373
7474
<%= nonced_stylesheet_link_tag "link.css" %>
75+
76+
<%= nonced_stylesheet_pack_tag "pack.css" %>
7577
```
7678

7779
becomes:
@@ -136,4 +138,4 @@ end
136138
class SessionsController < ApplicationController
137139
after_action :clear_browser_cache, only: :destroy
138140
end
139-
```
141+
```

lib/secure_headers/view_helper.rb

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,24 @@ def nonced_javascript_tag(content_or_options = {}, &block)
3434
# Instructs secure_headers to append a nonce to script-src directive.
3535
#
3636
# Returns an html-safe script tag with the nonce attribute.
37-
def nonced_javascript_include_tag(*args, &block)
38-
javascript_include_tag(*args, nonce: content_security_policy_nonce(:script), &block)
37+
def nonced_javascript_include_tag(*args, **kwargs, &block)
38+
javascript_include_tag(*args, kwargs.merge(nonce: content_security_policy_nonce(:script)), &block)
3939
end
4040

4141
# Public: create a script Webpacker pack tag using the content security policy nonce.
4242
# Instructs secure_headers to append a nonce to script-src directive.
4343
#
4444
# Returns an html-safe script tag with the nonce attribute.
45-
def nonced_javascript_pack_tag(*args, &block)
46-
javascript_pack_tag(*args, nonce: content_security_policy_nonce(:script), &block)
45+
def nonced_javascript_pack_tag(*args, **kwargs, &block)
46+
javascript_pack_tag(*args, kwargs.merge(nonce: content_security_policy_nonce(:script)), &block)
47+
end
48+
49+
# Public: create a stylesheet Webpacker link tag using the content security policy nonce.
50+
# Instructs secure_headers to append a nonce to style-src directive.
51+
#
52+
# Returns an html-safe link tag with the nonce attribute.
53+
def nonced_stylesheet_pack_tag(*args, **kwargs, &block)
54+
stylesheet_pack_tag(*args, kwargs.merge(nonce: content_security_policy_nonce(:style)), &block)
4755
end
4856

4957
# Public: use the content security policy nonce for this request directly.

spec/lib/secure_headers/view_helpers_spec.rb

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,12 @@ def self.template
4141
4242
<%= nonced_javascript_include_tag "include.js" %>
4343
44-
<%= nonced_javascript_pack_tag "pack.js" %>
44+
<%= nonced_javascript_pack_tag "pack.js", defer: true %>
4545
4646
<%= nonced_stylesheet_link_tag "link.css" %>
4747
48+
<%= nonced_stylesheet_pack_tag "pack.css", media: :all %>
49+
4850
TEMPLATE
4951
end
5052

@@ -80,6 +82,8 @@ def stylesheet_link_tag(source, options = {})
8082
content_tag(:link, nil, options.merge(href: source, rel: "stylesheet", media: "screen"))
8183
end
8284

85+
alias_method :stylesheet_pack_tag, :stylesheet_link_tag
86+
8387
def result
8488
super(binding)
8589
end

0 commit comments

Comments
 (0)