RELNOTES: Add nonce in goog.dom.safe.setLinkHrefAndRel.

We already do this goog.style.installSafeStyleSheet. PiperOrigin-RevId: 367961247
google · Apr 14, 2021 · 6c84afc · 6c84afc
1 parent 7d1c8f1
commit 6c84afc
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/closure/goog/dom/safe.js b/closure/goog/dom/safe.js
@@ -553,6 +553,11 @@ goog.dom.safe.setLinkHrefAndRel = function(link, url, rel) {
         url instanceof goog.html.TrustedResourceUrl,
         'URL must be TrustedResourceUrl because "rel" contains "stylesheet"');
     link.href = goog.html.TrustedResourceUrl.unwrap(url);
+    const win = link.ownerDocument && link.ownerDocument.defaultView;
+    const nonce = goog.dom.safe.getStyleNonce(win);
+    if (nonce) {
+      link.setAttribute('nonce', nonce);
+    }
   } else if (url instanceof goog.html.TrustedResourceUrl) {
     link.href = goog.html.TrustedResourceUrl.unwrap(url);
   } else if (url instanceof goog.html.SafeUrl) {

diff --git a/closure/goog/dom/safe_test.js b/closure/goog/dom/safe_test.js
@@ -176,7 +176,8 @@ testSuite({
 
   testsetLinkHrefAndRel_trustedResourceUrl() {
     const mockLink =
-        /** @type {!HTMLLinkElement} */ ({'href': null, 'rel': null});
+        /** @type {!HTMLLinkElement} */ (
+            {'href': null, 'rel': null, setAttribute: () => {}});
 
     const url =
         TrustedResourceUrl.fromConstant(Const.from('javascript:trusted();'));
@@ -190,7 +191,8 @@ testSuite({
 
   testsetLinkHrefAndRel_safeUrl() {
     const mockLink =
-        /** @type {!HTMLLinkElement} */ ({'href': null, 'rel': null});
+        /** @type {!HTMLLinkElement} */ (
+            {'href': null, 'rel': null, setAttribute: () => {}});
 
     const url = SafeUrl.fromConstant(Const.from('javascript:trusted();'));
     assertThrows(() => {
@@ -203,7 +205,8 @@ testSuite({
 
   testsetLinkHrefAndRel_string() {
     const mockLink =
-        /** @type {!HTMLLinkElement} */ ({'href': null, 'rel': null});
+        /** @type {!HTMLLinkElement} */ (
+            {'href': null, 'rel': null, setAttribute: () => {}});
 
     assertThrows(() => {
       safe.setLinkHrefAndRel(