Problem/Motivation

The kint PHP library supports adding nonces to its inline script through the AbstractRenderer::$js_nonce and AbstractRenderer::$css_nonce properties. We can add support for the csp module by filling these properties.

Issue fork kint-3551781

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

dieterholvoet created an issue. See original summary.

dieterholvoet opened merge request !9

dieterholvoet’s picture

dieterholvoet commented
Status: Active » Needs review
jnvsor’s picture

jnvsor commented

Hey Dieter, I noticed with your patch the nonce gets added ot the tags but drupal doesn't necessarily add the nonce to the header unless an event subscriber does it explicitly. This happens when csp_nonce is #attached but since kint echoes directly that's not an option.

I think there's no clean way to deal with this other than to add a nonce to every response with a csp header. Could you give this mr a once over and tell me if anything looks strange? Thanks

https://git.drupalcode.org/project/kint/-/merge_requests/10

dieterholvoet’s picture

dieterholvoet commented

Good catch! I commented in the MR.

jnvsor’s picture

jnvsor commented
Status: Needs review » Fixed

Thanks Dieter, released in 2.2.0

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.