const inline = 'script'; * * ``` * * @see https://docs.typo3.org/permalink/t3viewhelper:typo3-fluid-security-nonce * @see https://docs.typo3.org/permalink/t3coreapi:content-security-policy * @see \TYPO3\CMS\Core\Security\ContentSecurityPolicy\PolicyProvider */ final class NonceViewHelper extends AbstractViewHelper { public function __construct(private readonly RequestId $requestId) {} public function initializeArguments(): void { parent::initializeArguments(); $this->registerArgument('directive', 'string', 'Value of the CSP directive'); $this->registerArgument('scope', 'string', '`inline` or `static`', false, 'inline'); } public function render(): string { $applicableDirectives = SourceKeyword::nonceProxy->getApplicableDirectives(); $directive = Directive::tryFrom($this->arguments['directive'] ?? ''); $directive = $directive !== null && in_array($directive, $applicableDirectives, true) ? $directive->value : self::class; $scope = $this->arguments['scope'] ?? ''; if ($scope === 'static') { return $this->requestId->nonce->consumeStatic($directive); } // `inline` is guessed here, it might be `static` as well in templates return $this->requestId->nonce->consumeInline($directive); } }