Skip to content

Commit b5e39b1

Browse files
bgajjala8ZedLi
bgajjala8
and
ZedLi
committed
feat: 🎸 Add CSP nonce to code editors (#3230)
Co-authored-by: Zhihe Li <zhihe.li@hashicorp.com>
1 parent 4402f41 commit b5e39b1

5 files changed

Lines changed: 24 additions & 0 deletions

File tree

‎ui/admin/app/components/form/field/json-secret/index.hbs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
@isLintingEnabled={{true}}
2828
@language='json'
2929
@onInput={{@onInput}}
30+
@cspNonce={{(csp-nonce)}}
3031
data-test-code-editor
3132
/>
3233
{{/if}}

‎ui/admin/app/components/form/role/edit-grants/index.hbs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
@value={{this.grantStringsText}}
2424
@onInput={{this.onInput}}
2525
@customExtensions={{this.customExtensions}}
26+
@cspNonce={{(csp-nonce)}}
2627
data-test-code-editor
2728
as |CE|
2829
>

‎ui/admin/app/components/worker-filter-generator/index.hbs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
@language='shell'
1212
@value={{or (get @model @name) ''}}
1313
@onInput={{fn this.setWorkerFilter @model @name}}
14+
@cspNonce={{(csp-nonce)}}
1415
data-test-code-editor
1516
/>
1617
</F.Control>

‎ui/admin/app/helpers/csp-nonce.js‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* Copyright IBM Corp. 2021, 2026
3+
* SPDX-License-Identifier: BUSL-1.1
4+
*/
5+
6+
import Helper from '@ember/component/helper';
7+
8+
/**
9+
* Returns the CSP style-src nonce from the document's head metadata.
10+
*/
11+
export default class CspNonceHelper extends Helper {
12+
compute() {
13+
return (
14+
document
15+
?.querySelector('meta[name="csp-nonce"]')
16+
?.getAttribute('content')
17+
?.trim() ?? ''
18+
);
19+
}
20+
}

‎ui/admin/app/index.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
<!DOCTYPE html>
77
<html>
88
<head>
9+
<meta name="csp-nonce" content="__BOUNDARY_CSP_NONCE__">
910
<meta charset="utf-8">
1011
<title>Admin</title>
1112
<meta name="description" content="Simple and secure remote access with HashiCorp Boundary.">

0 commit comments

Comments
 (0)