Skip to content
This repository has been archived by the owner on May 2, 2024. It is now read-only.

Switch to selectlist fork with nonce support #141

Merged
merged 2 commits into from
Mar 14, 2024
Merged

Conversation

cjdenio
Copy link
Contributor

@cjdenio cjdenio commented Mar 13, 2024

I forked selectlist-polyfill to support CSP nonces (https://github.com/cjdenio/selectlist-polyfill) and confirmed it fixes the original issue. Also happy to transfer this repo to the Obl.ong GitHub org!

Resolves #138

@reesericci
Copy link
Member

This PR doesn't appear to send the nonce to the selectlist polyfill - how does it fetch the nonce?

@cjdenio
Copy link
Contributor Author

cjdenio commented Mar 13, 2024

Rails automatically adds a csp-nonce meta tag to the page header— it just reads from that

Screenshot 2024-03-13 at 5 14 53 PM

@reesericci
Copy link
Member

Is the csp-nonce tag a standard thing a polyfill should rely on existing?

@cjdenio
Copy link
Contributor Author

cjdenio commented Mar 13, 2024

It's a standard for all Rails apps, which this fork is really only designed to work with. There's no cross-framework way for JS packages to access the nonce, if that's what you mean

@reesericci
Copy link
Member

Alright cool, can you transfer that repo to obl-ong as well? LGTM!

@reesericci reesericci merged commit 9cc2b76 into obl-ong:main Mar 14, 2024
1 check failed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Revert CSP regression - fix no nonce on styling attribute on <selectlist>
2 participants