slackhq / csp-html-webpack-plugin

A plugin which, when combined with HTMLWebpackPlugin, adds CSP tags to the HTML output.
MIT License
163 stars 39 forks source link

CSP Plugin doesn't put the nonce value into CSP meta tag on Windows #93

Closed LightwithoutLisonlyight closed 3 years ago

LightwithoutLisonlyight commented 3 years ago

Description

Describe your issue here.

What type of issue is this? (place an x in one of the [ ])

Requirements (place an x in each of the [ ])


Bug Report

If i use this CSP configuration on Mac

new CspHtmlWebpackPlugin(
      {
        'script-src': ['\'strict-dynamic\''],
        'style-src': ['\'self\''],
        'frame-src': ['\'none\''],
        'worker-src': ['\'none\'']
      },
      {
        enabled: true,
        hashingMethod: 'sha512',
        hashEnabled: {
          'script-src': true,
          'style-src': true
        },
        nonceEnabled: {
          'script-src': true,
          'style-src': true,
        },
      }

But if i run the same on windows pc nonces doesn't will be added to content property of CSP's meta tag

<!DOCTYPE html>
 <html>
  <head>
     <meta http-equiv="Content-Security-Policy" content="base-uri 'self'; object-src 'none'; script-src 'nonce-gn67IhFu2jJyrwY+PMSeUA==' 'strict-dynamic'; style-src 'self' 'nonce-y3gcK9oDtWf74QiBnf2rSA=='; frame-src 'none'; worker-src 'none'">
 <meta charset="UTF-8">
 <title>Title</title>
 <script defer="defer" src="static/js/main.ba2c44d7bc58ccf6207d.bundle.js" nonce="gn67IhFu2jJyrwY+PMSeUA=="> </script>
  <link href="static/css/main.6ec92936e5acaa7eae9f.bundle.css" rel="stylesheet" nonce="y3gcK9oDtWf74QiBnf2rSA==">  
 </head>
 <body>
  <div id="root"></div>
 </body>
</html>

Reproducible in:

slackhq/csp-html-webpack-plugin version: ^5.1.0

node version:I'm using electron with node v12, but i've installed the latest LTS version

OS version(s):10.0.19041

Steps to reproduce:

1.Use my configuration on both OS 2. 3.

Expected result:

What you expected to happen: the same that happen on Mac

b-maslennikov commented 3 years ago

Confirming

b-maslennikov commented 3 years ago

Fixed this by updating node from 14.16.0 to 14.17.0 ¯_(ツ)_/¯