Another option is to create templates during assembly. Here is a simple example of using gulp to add one-time numbers to the CSP meta tag and inline script.
index.html
<!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'nonce-<%= scriptNonce %>';"> <title>Basic Electron App</title> </head> <body> <div id="app"></div> <script type="application/javascript" nonce=<%= scriptNonce %>> require('./index.js'); </script> </body> </html>
and in gulfile.js add the following to what you already have and make sure that this task is included in your pipeline. You can also simply update the current HTML task with the code below.
const template = require('gulp-template'); const uuidv4 = require('uuid/v4'); gulp.task('copy-html', () => { // Create nonces during the build and pass them to the template for use with inline scripts and styles const nonceData = { scriptNonce: new Buffer(uuidv4()).toString('base64'), styleNonce: new Buffer(uuidv4()).toString('base64') }; return gulp.src('src/*.html') .pipe(template(nonceData)) .pipe(gulp.dest('dist/')); });
This is a very truncated example. I have a more complete example at https://github.com/NFabrizio/data-entry-electron-app , if anyone is interested, although there is another warning when starting the application, because one of the packages I use is pulls in response-beautiful-dnd, which adds inline styles but doesn't currently accept disposable ones.
source share