Bug 1374612 - CSP: Hide nonce values from the DOM. r=smaug,annevk

Differential Revision: https://phabricator.services.mozilla.com/D62811
2020-02-29 12:35:46 +00:00
parent 7a2fa587e3
commit ae73f1a2cb
21 changed files with 172 additions and 356 deletions
--- a/dom/html/HTMLLinkElement.cpp
+++ b/dom/html/HTMLLinkElement.cpp
@@ -473,7 +473,10 @@ Maybe<nsStyleLinkElement::SheetInfo> HTMLLinkElement::GetStyleSheetInfo() {
  referrerInfo->InitWithNode(this);

  nsAutoString nonce;
-  GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
+  nsString* cspNonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
+  if (cspNonce) {
+    nonce = *cspNonce;
+  }

  return Some(SheetInfo{
      *OwnerDoc(),