From a77dde61705c353c2b9ad2e0bc2632afabaa5318 Mon Sep 17 00:00:00 2001
From: Cristen Jones <cjones3@mbta.com>
Date: Fri, 22 Nov 2024 16:40:41 -0500
Subject: [PATCH] more using nonce

---
 .../templates/fare/proposed_sales_locations.html.heex       | 1 +
 .../templates/fare/retail_sales_locations.html.heex         | 1 +
 lib/dotcom_web/templates/layout/root.html.heex              | 5 +++++
 lib/dotcom_web/templates/layout/style_guide.html.eex        | 2 +-
 lib/dotcom_web/templates/project/index.html.heex            | 2 ++
 lib/dotcom_web/templates/schedule/_line.html.heex           | 3 +++
 lib/dotcom_web/templates/stop/show.html.heex                | 4 ++++
 lib/dotcom_web/templates/transit_near_me/index.html.heex    | 3 +++
 lib/dotcom_web/templates/trip_plan/index.html.heex          | 6 ++++++
 9 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/lib/dotcom_web/templates/fare/proposed_sales_locations.html.heex b/lib/dotcom_web/templates/fare/proposed_sales_locations.html.heex
index ea01c4a062..1e47c9d76c 100644
--- a/lib/dotcom_web/templates/fare/proposed_sales_locations.html.heex
+++ b/lib/dotcom_web/templates/fare/proposed_sales_locations.html.heex
@@ -38,6 +38,7 @@
           src={static_url(@conn, "/js/tnm.js")}
           integrity={static_integrity(@conn, "/js/tnm.js")}
           crossorigin="anonymous"
+          nonce={assigns[:nonce]}
         >
         </script>
       <% end %>
diff --git a/lib/dotcom_web/templates/fare/retail_sales_locations.html.heex b/lib/dotcom_web/templates/fare/retail_sales_locations.html.heex
index 773a752457..8caacb2a35 100644
--- a/lib/dotcom_web/templates/fare/retail_sales_locations.html.heex
+++ b/lib/dotcom_web/templates/fare/retail_sales_locations.html.heex
@@ -23,6 +23,7 @@
           src={static_url(@conn, "/js/tnm.js")}
           integrity={static_integrity(@conn, "/js/tnm.js")}
           crossorigin="anonymous"
+          nonce={assigns[:nonce]}
         >
         </script>
       <% end %>
diff --git a/lib/dotcom_web/templates/layout/root.html.heex b/lib/dotcom_web/templates/layout/root.html.heex
index e2ca8167ab..87c3d2e899 100644
--- a/lib/dotcom_web/templates/layout/root.html.heex
+++ b/lib/dotcom_web/templates/layout/root.html.heex
@@ -79,6 +79,7 @@
       href={static_url(@conn, "/css/core.css")}
       integrity={static_integrity(@conn, "/css/core.css")}
       crossorigin="anonymous"
+      nonce={assigns[:nonce]}
     />
     <link
       :if={!dev_server?}
@@ -86,6 +87,7 @@
       href={static_url(@conn, "/css/app.css")}
       integrity={static_integrity(@conn, "/css/app.css")}
       crossorigin="anonymous"
+      nonce={assigns[:nonce]}
     />
     <script
       :if={!dev_server?}
@@ -93,6 +95,7 @@
       src={static_url(@conn, "/js/vendors.js")}
       integrity={static_integrity(@conn, "/js/vendors.js")}
       crossorigin="anonymous"
+      nonce={assigns[:nonce]}
     >
     </script>
     <script
@@ -101,6 +104,7 @@
       src={static_url(@conn, "/js/app.js")}
       integrity={static_integrity(@conn, "/js/app.js")}
       crossorigin="anonymous"
+      nonce={assigns[:nonce]}
     >
     </script>
   </head>
@@ -151,6 +155,7 @@
       src={static_url(@conn, "/js/react.js")}
       integrity={static_integrity(@conn, "/js/react.js")}
       crossorigin="anonymous"
+      nonce={assigns[:nonce]}
     >
     </script>
     <%!-- End unnecessary scripts --%>
diff --git a/lib/dotcom_web/templates/layout/style_guide.html.eex b/lib/dotcom_web/templates/layout/style_guide.html.eex
index 9239ebddde..2d3d20242e 100644
--- a/lib/dotcom_web/templates/layout/style_guide.html.eex
+++ b/lib/dotcom_web/templates/layout/style_guide.html.eex
@@ -37,7 +37,7 @@
         </div>
       </main>
       <footer></footer>
-      <script src="<%= static_url(@conn, "/js/app.js") %>"></script>
+      <script nonce={assigns[:nonce]} src="<%= static_url(@conn, "/js/app.js") %>"></script>
     </div>
   </body>
 </html>
diff --git a/lib/dotcom_web/templates/project/index.html.heex b/lib/dotcom_web/templates/project/index.html.heex
index 017fa7f677..b61b254d10 100644
--- a/lib/dotcom_web/templates/project/index.html.heex
+++ b/lib/dotcom_web/templates/project/index.html.heex
@@ -7,6 +7,7 @@
     src={static_url(@conn, "/js/react.js")}
     integrity={static_integrity(@conn, "/js/react.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
   <script
@@ -14,6 +15,7 @@
     src={static_url(@conn, "/js/projects.js")}
     integrity={static_integrity(@conn, "/js/projects.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
 <% end %>
diff --git a/lib/dotcom_web/templates/schedule/_line.html.heex b/lib/dotcom_web/templates/schedule/_line.html.heex
index b61319bd4e..d24f4d1a1c 100644
--- a/lib/dotcom_web/templates/schedule/_line.html.heex
+++ b/lib/dotcom_web/templates/schedule/_line.html.heex
@@ -25,6 +25,7 @@
   href={static_url(@conn, "/css/map.css")}
   integrity={static_integrity(@conn, "/css/map.css")}
   crossorigin="anonymous"
+  nonce={assigns[:nonce]}
 />
 <%= if Application.get_env(:dotcom, :dev_server?) do %>
   <script defer src={"#{Application.get_env(:dotcom, :webpack_path)}/schedule.js"}>
@@ -35,6 +36,7 @@
     src={static_url(@conn, "/js/react.js")}
     integrity={static_integrity(@conn, "/js/react.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
   <script
@@ -42,6 +44,7 @@
     src={static_url(@conn, "/js/schedule.js")}
     integrity={static_integrity(@conn, "/js/schedule.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
 <% end %>
diff --git a/lib/dotcom_web/templates/stop/show.html.heex b/lib/dotcom_web/templates/stop/show.html.heex
index 3a65cdd27a..f1e3f8a56b 100644
--- a/lib/dotcom_web/templates/stop/show.html.heex
+++ b/lib/dotcom_web/templates/stop/show.html.heex
@@ -3,6 +3,7 @@
   href={static_url(@conn, "/css/map.css")}
   integrity={static_integrity(@conn, "/css/map.css")}
   crossorigin="anonymous"
+  nonce={assigns[:nonce]}
 />
 <div>
   <div id="react-stop-root" data-mbta-stop-id={@stop_id}></div>
@@ -17,6 +18,7 @@
     src={static_url(@conn, "/js/react.js")}
     integrity={static_integrity(@conn, "/js/react.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
   <script
@@ -24,6 +26,7 @@
     src={static_url(@conn, "/js/leaflet.js")}
     integrity={static_integrity(@conn, "/js/leaflet.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
   <script
@@ -31,6 +34,7 @@
     src={static_url(@conn, "/js/stop.js")}
     integrity={static_integrity(@conn, "/js/stop.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
 <% end %>
diff --git a/lib/dotcom_web/templates/transit_near_me/index.html.heex b/lib/dotcom_web/templates/transit_near_me/index.html.heex
index 856271e9ee..7bd4f046b2 100644
--- a/lib/dotcom_web/templates/transit_near_me/index.html.heex
+++ b/lib/dotcom_web/templates/transit_near_me/index.html.heex
@@ -10,6 +10,7 @@
   href={static_url(@conn, "/css/map.css")}
   integrity={static_integrity(@conn, "/css/map.css")}
   crossorigin="anonymous"
+  nonce={assigns[:nonce]}
 />
 <script data-for="tnm-map" id="js-tnm-map-dynamic-data" type="text/plain">
   <%= raw Poison.encode!(@map_data) %>
@@ -30,6 +31,7 @@
     src={static_url(@conn, "/js/react.js")}
     integrity={static_integrity(@conn, "/js/react.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
   <script
@@ -37,6 +39,7 @@
     src={static_url(@conn, "/js/tnm.js")}
     integrity={static_integrity(@conn, "/js/tnm.js")}
     crossorigin="anonymous"
+    nonce={assigns[:nonce]}
   >
   </script>
 <% end %>
diff --git a/lib/dotcom_web/templates/trip_plan/index.html.heex b/lib/dotcom_web/templates/trip_plan/index.html.heex
index f31d31495c..ee1d1af798 100644
--- a/lib/dotcom_web/templates/trip_plan/index.html.heex
+++ b/lib/dotcom_web/templates/trip_plan/index.html.heex
@@ -8,6 +8,7 @@
         href={static_url(@conn, "/css/map.css")}
         integrity={static_integrity(@conn, "/css/map.css")}
         crossorigin="anonymous"
+        nonce={assigns[:nonce]}
       />
       <%= case assigns[:query] do %>
         <% %{itineraries: {:ok, _}} -> %>
@@ -39,6 +40,7 @@
               src={static_url(@conn, "/js/react.js")}
               integrity={static_integrity(@conn, "/js/react.js")}
               crossorigin="anonymous"
+              nonce={assigns[:nonce]}
             >
             </script>
             <script
@@ -46,6 +48,7 @@
               src={static_url(@conn, "/js/tripplanresults.js")}
               integrity={static_integrity(@conn, "/js/tripplanresults.js")}
               crossorigin="anonymous"
+              nonce={assigns[:nonce]}
             >
             </script>
           <% end %>
@@ -66,6 +69,7 @@
               href={static_url(@conn, "/css/map.css")}
               integrity={static_integrity(@conn, "/css/map.css")}
               crossorigin="anonymous"
+              nonce={assigns[:nonce]}
             />
             <div class="trip-plan-initial-map map" id="react-root"></div>
             <%= if Application.get_env(:dotcom, :dev_server?) do %>
@@ -80,6 +84,7 @@
                 src={static_url(@conn, "/js/react.js")}
                 integrity={static_integrity(@conn, "/js/react.js")}
                 crossorigin="anonymous"
+                nonce={assigns[:nonce]}
               >
               </script>
               <script
@@ -87,6 +92,7 @@
                 src={static_url(@conn, "/js/tripplanner.js")}
                 integrity={static_integrity(@conn, "/js/tripplanner.js")}
                 crossorigin="anonymous"
+                nonce={assigns[:nonce]}
               >
               </script>
             <% end %>