-
Notifications
You must be signed in to change notification settings - Fork 0
/
App.tsx
139 lines (125 loc) · 3.6 KB
/
App.tsx
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
import {
FC,
Fragment,
h,
renderSSR,
} from "https://deno.land/x/nano_jsx@v0.0.34/mod.ts";
import { highlightText } from "https://deno.land/x/speed_highlight_js@1.1.7/dist/index.js";
import "https://deno.land/x/speed_highlight_js@1.1.7/dist/languages/js.js";
type Props = {
nonce?: string;
};
const jsCode = await highlightText(
`var scriptElement = document.createElement('script');
scriptElement.innerHTML = 'alert("Hello World!")';
document.body.append(scriptElement);`,
"js",
false,
);
const App: FC<Props> = ({ nonce }) => {
return (
<html>
<head>
<title>nonce</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<link
rel="stylesheet"
href="https://cdn.jsdelivr.net/npm/bulma@0.9.4/css/bulma.min.css"
/>
<link
rel="stylesheet"
href="https://unpkg.com/@speed-highlight/core@1.1.7/dist/themes/default.css"
/>
<script nonce={nonce}>
console.log('Hi from "nonce" script!');
</script>
<script>console.log('Hi from "non-nonce" script!');</script>
</head>
<body>
<div class="m-4">
<div class="container content">
<h1 class="title">nonce</h1>
<p>Open the developer tool on console panel and reload the page.</p>
<p>
Copy & paste the following script and check the differences
between enabling/disabling the{" "}
<ExternalLink href="https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce">
nonce
</ExternalLink>.
</p>
<div
style={{
"font": "16px monospace",
"line-height": "1.5",
"overflow": "auto",
}}
class="shj-lang-js mb-5"
dangerouslySetInnerHTML={{ __html: jsCode }}
/>
<CSPMessage nonce={nonce} />
Hosted by{" "}
<ExternalLink href="https://deno.com/deploy">
Deno Deploy
</ExternalLink>. Source code on{" "}
<ExternalLink href="https://github.com/marcomontalbano/test-nonce">
GitHub
</ExternalLink>.
</div>
</div>
</body>
</html>
);
};
export function getHTML({ nonce }: Props): string {
return renderSSR(<App nonce={nonce} />);
}
const ExternalLink: FC<{ href: string; children: Element | string }> = (
{ href, children },
) => {
return (
<span class="icon-text">
<a
href={href}
target="_blank"
>
{children}
<span class="icon">
<svg
width="8"
height="8"
stroke="1"
viewBox="0 0 24 24"
xmlns="http://www.w3.org/2000/svg"
fill-rule="evenodd"
clip-rule="evenodd"
>
<path d="M14 4h-13v18h20v-11h1v12h-22v-20h14v1zm10 5h-1v-6.293l-11.646 11.647-.708-.708 11.647-11.646h-6.293v-1h8v8z" />
</svg>
</span>
</a>
</span>
);
};
const CSPMessage: FC<Props> = ({ nonce }) => {
return nonce
? (
<>
<article class="message is-success">
<div class="message-body">
Content Security Policy is set.<br />
<a href="/">disable</a>
</div>
</article>
</>
)
: (
<>
<article class="message is-warning">
<div class="message-body">
Content Security Policy is not set.<br />
<a href="/nonce">enable</a>
</div>
</article>
</>
);
};