Add CSP nonce. Resolves: maddalax#69

rafaelDev0ps · Jan 15, 2025 · 3a23e7e · 3a23e7e
1 parent 66b6dff
commit 3a23e7e
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/framework/h/render.go b/framework/h/render.go
@@ -20,6 +20,12 @@ func WithDocType() RenderOpt {
 	}
 }
 
+func WithNonce(nonce string) RenderOpt {
+	return func(context *RenderContext, opt *RenderOptions) {
+		context.nonce = nonce
+	}
+}
+
 // Render renders the given node recursively, and returns the resulting string.
 func Render(node Ren, opts ...RenderOpt) string {
 	builder := &strings.Builder{}

diff --git a/framework/h/renderer.go b/framework/h/renderer.go
@@ -2,10 +2,11 @@ package h
 
 import (
 	"fmt"
-	"github.com/maddalax/htmgo/framework/hx"
 	"html"
 	"html/template"
 	"strings"
+
+	"github.com/maddalax/htmgo/framework/hx"
 )
 
 type CustomElement = string
@@ -44,16 +45,17 @@ type RenderContext struct {
 	builder        *strings.Builder
 	scripts        []ScriptEntry
 	currentElement *Element
+	nonce          string
 }
 
 func (ctx *RenderContext) AddScript(funcName string, body string) {
 	script := fmt.Sprintf(`
-	<script id="%s">
+	<script id="%s" nonce="%s">
 		function %s(self, event) {
 				let e = event;
 				%s
 		}
-	</script>`, funcName, funcName, body)
+	</script>`, funcName, ctx.nonce, funcName, body)
 
 	ctx.scripts = append(ctx.scripts, ScriptEntry{
 		Body:    script,