feat(ssr): Add 'nonce' option to context for ssr outlet script (#8047)

Hyunje Jun · yyx990803 · commit f036cce16377 · 2018-12-20T15:15:04.000-05:00
close #7479
diff --git a/src/server/template-renderer/index.js b/src/server/template-renderer/index.js
@@ -198,8 +198,9 @@ export default class TemplateRenderer {
     const autoRemove = process.env.NODE_ENV === 'production'
       ? ';(function(){var s;(s=document.currentScript||document.scripts[document.scripts.length-1]).parentNode.removeChild(s);}());'
       : ''
+    const nonceAttr = context.nonce ? ` nonce="${context.nonce}"` : ''
     return context[contextKey]
-      ? `<script>window.${windowKey}=${state}${autoRemove}</script>`
+      ? `<script${nonceAttr}>window.${windowKey}=${state}${autoRemove}</script>`
       : ''
   }
 
diff --git a/test/ssr/ssr-template.spec.js b/test/ssr/ssr-template.spec.js
@@ -387,5 +387,32 @@ describe('SSR: template option', () => {
         done()
       })
     })
+
+    it('renderToString + nonce', done => {
+      const interpolateTemplate = `<html><head><title>hello</title></head><body><!--vue-ssr-outlet--></body></html>`
+      const renderer = createRenderer({
+        template: interpolateTemplate
+      })
+
+      const context = {
+        state: { a: 1 },
+        nonce: '4AEemGb0xJptoIGFP3Nd'
+      }
+
+      renderer.renderToString(new Vue({
+        template: '<div>hi</div>'
+      }), context, (err, res) => {
+        expect(err).toBeNull()
+        expect(res).toContain(
+          `<html><head>` +
+          `<title>hello</title>` +
+          `</head><body>` +
+          `<div data-server-rendered="true">hi</div>` +
+          `<script nonce="4AEemGb0xJptoIGFP3Nd">window.__INITIAL_STATE__={"a":1}</script>` +
+          `</body></html>`
+        )
+        done()
+      })
+    })
   }
 })
