{"action":"closed","issue":{"url":"https://api.github.com/repos/quasarframework/quasar-cli/issues/87","repository_url":"https://api.github.com/repos/quasarframework/quasar-cli","labels_url":"https://api.github.com/repos/quasarframework/quasar-cli/issues/87/labels{/name}","comments_url":"https://api.github.com/repos/quasarframework/quasar-cli/issues/87/comments","events_url":"https://api.github.com/repos/quasarframework/quasar-cli/issues/87/events","html_url":"https://github.com/quasarframework/quasar-cli/issues/87","id":304540708,"number":87,"title":"Add config parameter to quasar.conf.js to assign a nonce to inline scripts","user":{"login":"miketrebilcock","id":1905325,"avatar_url":"https://avatars3.githubusercontent.com/u/1905325?v=4","gravatar_id":"","url":"https://api.github.com/users/miketrebilcock","html_url":"https://github.com/miketrebilcock","followers_url":"https://api.github.com/users/miketrebilcock/followers","following_url":"https://api.github.com/users/miketrebilcock/following{/other_user}","gists_url":"https://api.github.com/users/miketrebilcock/gists{/gist_id}","starred_url":"https://api.github.com/users/miketrebilcock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miketrebilcock/subscriptions","organizations_url":"https://api.github.com/users/miketrebilcock/orgs","repos_url":"https://api.github.com/users/miketrebilcock/repos","events_url":"https://api.github.com/users/miketrebilcock/events{/privacy}","received_events_url":"https://api.github.com/users/miketrebilcock/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-12T21:08:25Z","updated_at":"2018-03-12T22:58:57Z","closed_at":"2018-03-12T22:58:56Z","author_association":"NONE","body":"Applying [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src) is currently not entirely possible due to the inclusion of PWA scripts during webpack build. Whilst there is a webpack plugin that adds an sri attribute to external scripts, the current config requires unsafe-inline to be used.  The ability to add a nonce to the quasar.conf.js which could be included, if present, during build would enable stronger CSP. Something like:\r\n\r\n```\r\nfunction getBodyScripts (cfg) {\r\n  let output = ''\r\n  if (cfg.ctx.mode.cordova) {\r\n    output += `<script type=\"text/javascript\" src=\"cordova.js\"></script>`\r\n  }\r\n  if (cfg.ctx.dev) {\r\n    output += `\r\n      <script>\r\n        console.info('[Quasar] Running ${cfg.ctx.modeName.toUpperCase()} with ${cfg.ctx.themeName.toUpperCase()} theme.')\r\n      </script>\r\n    `\r\n  }\r\n  if (cfg.ctx.mode.pwa) {\r\n    let nonce = ''\r\n    if (cfg.ctx.script_nonce) {\r\n      nonce = `nonce=$cfg.ctx.script_nonce`\r\n    }\r\n    if (cfg.ctx.dev) {\r\n      output += `\r\n        <script $nonce>\r\n          ${fs.readFileSync(appPaths.resolve.pwa('service-worker-dev.js'), 'utf-8')}\r\n        </script>\r\n      `\r\n    }\r\n    else {\r\n      const load = cfg.build.minify\r\n        ? require('./load-minified')\r\n        : file => fs.readFileSync(file, 'utf-8')\r\n\r\n      output += `\r\n        <script $nonce>\r\n          ${load(appPaths.resolve.pwa('service-worker-prod.js'))}\r\n        </script>\r\n      `\r\n    }\r\n  }\r\n```\r\nThe developer would then be able to add the nonce to the response headers.\r\n\r\nI'll put together an pull request and submit it."}}
{"actor":{"display_login":"miketrebilcock"}}