Repository navigation
Interactivity API: CSP-Safe Inline JS Expressions - #82155
Open
nickchomey wants to merge 19 commits into
Open
nickchomey wants to merge 19 commits into
nickchomey wants to merge 19 commits into
Conversation
- Tests for splitStatements: null cases, basic split, string/regex/template literal handling, mixed content, non-string input - Tests for getEvaluate full-expression path: context comparisons (!==, ===), ternary, negation, logical operators, array filter, multi-statement, invalid expressions, backward-compatible fast path
…ake sure that hasNegativeOperator is working
…ting shows it is even fast
…ass now as they go through full expression path
…ipt, caching, Trusted Types
…thout unsafe-eval
nickchomey
requested review from
DAreRodz,
ajitbohra,
luisherranz and
ntwb
as code owners
August 27, 2026 23:02
|
Warning: Type of PR label mismatch To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.
Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task. |
1 similar comment
|
Warning: Type of PR label mismatch To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.
Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task. |
github-actions
Bot
added
[Package] E2E Tests
Contributor
Author
|
this should probably also change to |
nickchomey
requested review from
desrosj,
spacedmonkey and
tellthemachines
as code owners
October 17, 2026 20:58
github-actions
Bot
added
[Package] Block editor
nickchomey
force-pushed
the
add/interactivity-full-expressions
branch
from
October 17, 2026 21:03
0d7c912 to
37cb4a2
Compare
github-actions
Bot
added
[Package] E2E Tests
5 of 10 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Closes #79765
Why?
So, here's an interesting development. Datastar just released v1.0.3, which includes a CSP mechanism. They use a
data-nonce="abc123"attribute on the document root plus ascript-src 'nonce-abc123'header so inline expressions evaluate without unsafe-eval.As they note in their docs, you still have to be careful putting user input in HTML templates, but that's always been the case.
This PR refreshes #79780 with that same mechanism layered on top. There are unit and e2e tests covering several CSP permutations (no CSP, unsafe-eval, nonce, and strict policies with neither). It works as expected.
How it behaves:
unsafe-eval: still Function().data-noncepresent on<html>: a new mechanism compiles each expression by injecting it into a<script nonce="...">element, soscript-src 'nonce-...'works withoutunsafe-eval. The attribute is read and removed at runtime.unsafe-eval: expressions aren't compiled, same as today - the iAPI degrades like any other script under a policy that disallows it.One detail worth calling out: the JS can't read the CSP header, so the server communicates the nonce via the
data-nonceattribute. The same nonce must appear in both theContent-Security-Policyheader and the<html data-nonce="...">attribute, and the server is responsible for noncing the iAPI module script too.Given this addresses the primary concern from #79780 - that sites would otherwise need unsafe-eval - is this something you'd be open to considering?
Note: the branch isn't rebased on trunk (local dev reasons). Not important for an initial review
Testing Instructions
The behaviour is covered by unit tests for the JS compilation path (
packages/interactivity/src/test/csp.ts) and e2e tests that drive a real browser under different CSP policies (test/e2e/specs/interactivity/csp-nonce.spec.ts). The e2e tests intercept the document response and inject theContent-Security-Policyheader +data-nonceattribute, simulating what a server/CDN would send — no PHP required to exercise the JS path.The e2e matrix:
data-nonceFunction())'self' 'unsafe-eval' 'unsafe-inline'Function())'self' 'nonce-...'<script>compilation;data-nonceremoved)'self' 'unsafe-inline'unsafe-eval, no nonce)'nonce-...' 'strict-dynamic'data-noncestays)The last two confirm the failure modes: without
unsafe-evalor a nonce, expressions don't evaluate; and a nonce on<html>alone isn't enough — the iAPI module script must also carry the nonce, which is the server's responsibility (mirrored in the mu-plugin via thewp_inline_script_attributes/wp_script_attributesfilters).npm run test:e2e -- test/e2e/specs/interactivity/csp-nonce.spec.tsnpm run test:unit packages/interactivity/src/test/csp.tsiapi-nonces.zip
Use of AI Tools
HY3, Muse Spark 1.2 via VS Code Copilot Chat as a pair programmer.