Package sk.iway.iwcm.doc.showdoc

Class NonceHelper

java.lang.Object
sk.iway.iwcm.doc.showdoc.NonceHelper
public final class NonceHelper extends Object
Helper class for Content-Security-Policy (CSP) nonce functionality. Handles nonce injection into HTML tags, inline style/event handler migration, and CSP configuration parsing.

  • Method Details

    • injectCspNonceIntoTags

      public static String injectCspNonceIntoTags(String htmlContent, String nonce, boolean injectIntoScripts, boolean injectIntoStyles)
      Injects a CSP nonce into <script>, <style>, and <link rel="stylesheet"> tags in a single pass. Optimized for memory efficiency: uses single StringBuilder, processes all tag types in one pass.
      Parameters:
      htmlContent - The HTML content to process
      nonce - The CSP nonce value
      injectIntoScripts - Whether to inject nonce into <script> tags (false if script-src allows unsafe-inline)
      injectIntoStyles - Whether to inject nonce into <style> and <link> tags (false if style-src allows unsafe-inline)
      Returns:
      HTML content with nonce injected into eligible tags

    • processTagForNonce

      protected static String processTagForNonce(String tagContent, String nonce, Pattern scriptPattern, Pattern stylePattern, Pattern linkPattern, boolean injectIntoScripts, boolean injectIntoStyles)
      Processes a single tag (script, style, or link) to inject nonce if not already present. Skips injection for tag types whose corresponding CSP directive allows unsafe-inline.
      Parameters:
      tagContent - The matched tag string
      nonce - The CSP nonce value
      scriptPattern - Pre-compiled pattern for script tags
      stylePattern - Pre-compiled pattern for style tags
      linkPattern - Pre-compiled pattern for link tags
      injectIntoScripts - Whether to inject nonce into script tags
      injectIntoStyles - Whether to inject nonce into style/link tags
      Returns:
      Processed tag string

    • processInlineStyles

      public static String processInlineStyles(String htmlContent, String nonce)
      Processes inline styles by replacing them with data attributes and injecting CSS rules with nonce. For elements with inline style="...", replaces with data-inline-style="counter" and generates CSS rules like [data-inline-style="1"] { property: value !important; }.
      Parameters:
      htmlContent - The HTML content
      nonce - The CSP nonce
      Returns:
      Processed HTML with inline styles replaced and CSS injected

    • processInlineEventHandlers

      public static String processInlineEventHandlers(String htmlContent, String nonce)
      Processes inline event handlers by replacing them with data attributes and injecting JavaScript with nonce. For elements with inline event handlers (onclick, onmouseover, etc.), replaces with data-inline-onclick="counter" and generates JavaScript code to restore the handlers.
      Parameters:
      htmlContent - The HTML content
      nonce - The CSP nonce
      Returns:
      Processed HTML with inline event handlers replaced and JavaScript injected

    • isDirectiveAllowsUnsafeInline

      public static boolean isDirectiveAllowsUnsafeInline(String cspValue, String directiveName)
      Checks if a specific CSP directive allows 'unsafe-inline'. Parses using indexOf to find the directive start and end (next ';' or end of string), then checks if 'unsafe-inline' exists within that range.
      Parameters:
      cspValue - The full CSP configuration string
      directiveName - The directive name to check (e.g., "script-src", "style-src")
      Returns:
      true if the directive allows 'unsafe-inline'