nuxt-security icon indicating copy to clipboard operation
nuxt-security copied to clipboard
verified publisher icon Baroshem

fix(cspSsrNonce): more robust tag replacement

Open GalacticHypernova opened this issue 1 month ago • 4 comments

Types of changes

  • [x] Bug fix (a non-breaking change which fixes an issue)
  • [ ] New feature (a non-breaking change which adds functionality)
  • [ ] Breaking change (fix or feature that would cause existing functionality to change)

Description

Closes #594 Closes #610 The previous regex implementation, upon further review, had quite a few edge cases. Custom elements, and tags within other elements' props, can cause false modifications, yielding unexpected behavior. This PR fixes the regexes to make them much more robust, fixing said pitfalls. It uses a 2 step approach to mask stringified elements and word-boundaried regex to fix custom elements

Checklist:

  • [ ] My change requires a change to the documentation.
  • [ ] I have updated the documentation accordingly.
  • [ ] I have added tests to cover my changes (if not applicable, please state why)

GalacticHypernova avatar Oct 26 '25 20:10 GalacticHypernova

@GalacticHypernova is attempting to deploy a commit to the Baroshem's projects Team on Vercel.

A member of the Team first needs to authorize it.

vercel[bot] avatar Oct 26 '25 20:10 vercel[bot]

Hey @vejja @Baroshem

Sorry for the double mention, but could this be prioritized for a push?

I tried to make a test for the fix (as you can see from the below commits) but I unfortunately failed. If you could assist with writing the test that would be appreciated (it's commented out in the ssr nonce test file)

GalacticHypernova avatar Oct 27 '25 23:10 GalacticHypernova

This appears to be even more performant than current variation (I'm assuming maybe the word boundary has something to do with that), but we can probably optimize it further. For exanple, we could perhaps quote entire attribute lines as opposed to individual attribute values, which might lead to a moderately smaller internal array, but it is low priority as the current approach is not a bottleneck, so this optimization could be safely pushed separately and should not be a blocker for merging this fix.

GalacticHypernova avatar Oct 29 '25 16:10 GalacticHypernova

I just pushed a PR to Nuxt Image to remove the insecure nonce prop, hopefully it is merged and allows us to simplify link handling 😅

GalacticHypernova avatar Oct 29 '25 19:10 GalacticHypernova

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
nuxt-security Ready Ready Preview Comment Nov 14, 2025 9:33am

vercel[bot] avatar Nov 14 '25 09:11 vercel[bot]