Repository: apollographql/apollo-server
Pull request #7672 (2023-08-03 23:29:52)

Add missing `nonce` to `script` tag
Follow-up to https://github.com/apollographql/apollo-server/security/advisories/GHSA-68jh-rf6x-836f

netlify[bot]: ### <span aria-hidden="true">👷</span> Deploy Preview for *apollo-server-docs* processing.


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | ccb256d867f738e073a1f56d06f8925b6c8dfd82 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/apollo-server-docs/deploys/64cc3872a455c20008b7307e |
codesandbox-ci[bot]: This pull request is automatically built and testable in [CodeSandbox](https://codesandbox.io).

  To see build info of the built libraries, click [here](https://ci.codesandbox.io/status/apollographql/apollo-server/pr/7672/builds/404589) or the icon next to each commit SHA.

Latest deployment of this branch, based on commit ccb256d867f738e073a1f56d06f8925b6c8dfd82:

|Sandbox| Source |
|--|--|
|[Apollo Server Typescript](https://codesandbox.io/s/apollo-server-typescript-wsf6ty)| Configuration |
|[Apollo Server](https://codesandbox.io/s/apollo-server-srr7fm)| Configuration |


Patch:
diff --git a/.changeset/rude-monkeys-pay.md b/.changeset/rude-monkeys-pay.md
new file mode 100644
index 000000000..a9e0c7473
--- /dev/null
+++ b/.changeset/rude-monkeys-pay.md
@@ -0,0 +1,5 @@
+---
+'@apollo/server': patch
+---
+
+Add missing `nonce` on `script` tag for non-embedded landing page
diff --git a/packages/server/src/plugin/landingPage/default/index.ts b/packages/server/src/plugin/landingPage/default/index.ts
index 2085b7949..9a708450e 100644
--- a/packages/server/src/plugin/landingPage/default/index.ts
+++ b/packages/server/src/plugin/landingPage/default/index.ts
@@ -72,7 +72,7 @@ const getNonEmbeddedLandingPageHTML = (
   <h1>Welcome to Apollo Server</h1>
   <p>The full landing page cannot be loaded; it appears that you might be offline.</p>
 </div>
-<script>window.landingPage = ${encodedConfig};</script>
+<script nonce="${nonce}">window.landingPage = ${encodedConfig};</script>
 <script nonce="${nonce}" src="https://apollo-server-landing-page.cdn.apollographql.com/${encodeURIComponent(
     cdnVersion,
   )}/static/js/main.js?runtime=${apolloServerVersion}"></script>`;


Test patch:
diff --git a/packages/server/src/__tests__/plugin/landingPage/plugin.test.ts b/packages/server/src/__tests__/plugin/landingPage/plugin.test.ts
index f38fa91ea..5ce3e434d 100644
--- a/packages/server/src/__tests__/plugin/landingPage/plugin.test.ts
+++ b/packages/server/src/__tests__/plugin/landingPage/plugin.test.ts
@@ -1,5 +1,8 @@
 import { ApolloServer, HeaderMap } from '@apollo/server';
-import { ApolloServerPluginLandingPageLocalDefault } from '@apollo/server/plugin/landingPage/default';
+import {
+  ApolloServerPluginLandingPageLocalDefault,
+  ApolloServerPluginLandingPageProductionDefault,
+} from '@apollo/server/plugin/landingPage/default';
 import { describe, expect, test } from '@jest/globals';
 import assert from 'assert';
 import { mockLogger } from '../../mockLogger';
@@ -61,4 +64,16 @@ describe('ApolloServerPluginLandingPageDefault', () => {
     );
     await server.stop();
   });
+
+  test(`nonce exists in non-embedded landing page`, async () => {
+    const plugin = ApolloServerPluginLandingPageProductionDefault({
+      embed: false,
+    });
+
+    // @ts-ignore not passing things to `serverWillStart`
+    const { renderLandingPage } = await plugin.serverWillStart?.({});
+    const landingPageHtml = await (await renderLandingPage?.()).html();
+
+    expect(landingPageHtml).toMatch(/<script nonce=".*">window\.landingPage/);
+  });
 });