fix: ensure CSP nonces are Base64 encoded (#9907)

paulbalandan · web-flow · commit 4cdbee1a6489 · 2026-02-01T21:48:25.000+08:00
diff --git a/system/HTTP/ContentSecurityPolicy.php b/system/HTTP/ContentSecurityPolicy.php
@@ -303,7 +303,7 @@ public function enabled(): bool
     public function getStyleNonce(): string
     {
         if ($this->styleNonce === null) {
-            $this->styleNonce = bin2hex(random_bytes(12));
+            $this->styleNonce = base64_encode(random_bytes(12));
             $this->styleSrc[] = 'nonce-' . $this->styleNonce;
         }
 
@@ -316,7 +316,7 @@ public function getStyleNonce(): string
     public function getScriptNonce(): string
     {
         if ($this->scriptNonce === null) {
-            $this->scriptNonce = bin2hex(random_bytes(12));
+            $this->scriptNonce = base64_encode(random_bytes(12));
             $this->scriptSrc[] = 'nonce-' . $this->scriptNonce;
         }
 
diff --git a/tests/system/CommonFunctionsTest.php b/tests/system/CommonFunctionsTest.php
@@ -731,7 +731,7 @@ public function testDWithCSP(): void
         $cliDetection        = Kint::$cli_detection;
         Kint::$cli_detection = false;
 
-        $this->expectOutputRegex('/<script class="kint-rich-script" nonce="[0-9a-z]{24}">/u');
+        $this->expectOutputRegex('/<script class="kint-rich-script" nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}">/u');
         d('string');
 
         // Restore settings
@@ -754,7 +754,7 @@ public function testTraceWithCSP(): void
 
         Kint::$cli_detection = false;
 
-        $this->expectOutputRegex('/<style class="kint-rich-style" nonce="[0-9a-z]{24}">/u');
+        $this->expectOutputRegex('/<style class="kint-rich-style" nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}">/u');
         trace();
     }
 
diff --git a/tests/system/HTTP/ContentSecurityPolicyTest.php b/tests/system/HTTP/ContentSecurityPolicyTest.php
@@ -578,18 +578,20 @@ public function testGetScriptNonce(): void
     {
         $this->prepare();
 
-        $nonce = $this->csp->getScriptNonce();
-
-        $this->assertMatchesRegularExpression('/\A[0-9a-z]{24}\z/', $nonce);
+        $this->assertMatchesRegularExpression(
+            '/\A[a-zA-Z0-9+\/-_]+[=]{0,2}\z/',
+            $this->csp->getScriptNonce(),
+        );
     }
 
     public function testGetStyleNonce(): void
     {
         $this->prepare();
 
-        $nonce = $this->csp->getStyleNonce();
-
-        $this->assertMatchesRegularExpression('/\A[0-9a-z]{24}\z/', $nonce);
+        $this->assertMatchesRegularExpression(
+            '/\A[a-zA-Z0-9+\/-_]+[=]{0,2}\z/',
+            $this->csp->getStyleNonce(),
+        );
     }
 
     #[PreserveGlobalState(false)]
diff --git a/tests/system/Helpers/HTMLHelperTest.php b/tests/system/Helpers/HTMLHelperTest.php
@@ -337,7 +337,7 @@ public function testScriptTagWithCsp(): void
         $html   = script_tag($target);
 
         $this->assertMatchesRegularExpression(
-            '!<script nonce="\w+?" src="http://site.com/js/mystyles.js".*?>!u',
+            '!<script nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}" src="http://site.com/js/mystyles.js".*?>!u',
             $html,
         );
 
diff --git a/tests/system/Helpers/URLHelper/MiscUrlTest.php b/tests/system/Helpers/URLHelper/MiscUrlTest.php
@@ -493,7 +493,7 @@ public function testSafeMailtoWithCsp(): void
 
         $html = safe_mailto('foo@example.jp', 'Foo');
 
-        $this->assertMatchesRegularExpression('/<script .*?nonce="\w+?".*?>/u', $html);
+        $this->assertMatchesRegularExpression('/<script .*?nonce="[a-zA-Z0-9+\/]+[=]{0,2}".*?>/u', $html);
     }
 
     /**
diff --git a/tests/system/Honeypot/HoneypotTest.php b/tests/system/Honeypot/HoneypotTest.php
@@ -107,7 +107,7 @@ public function testAttachHoneypotAndContainerWithCSP(): void
         $this->response->setBody('<head></head><body><form></form></body>');
         $this->honeypot->attachHoneypot($this->response);
 
-        $regex = '!<head><style nonce="[0-9a-f]+">#hpc { display:none }</style></head><body><form><div style="display:none" id="hpc"><label>Fill This Field</label><input type="text" name="honeypot" value=""></div></form></body>!u';
+        $regex = '!<head><style nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}">#hpc { display:none }</style></head><body><form><div style="display:none" id="hpc"><label>Fill This Field</label><input type="text" name="honeypot" value=""></div></form></body>!u';
         $this->assertMatchesRegularExpression($regex, $this->response->getBody());
     }
 
diff --git a/tests/system/View/ParserPluginTest.php b/tests/system/View/ParserPluginTest.php
@@ -151,7 +151,7 @@ public function testCspScriptNonceWithCspEnabled(): void
         $template = 'aaa {+ csp_script_nonce +} bbb';
 
         $this->assertMatchesRegularExpression(
-            '/aaa nonce="[0-9a-z]{24}" bbb/',
+            '/aaa nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}" bbb/',
             $this->parser->renderString($template),
         );
     }
diff --git a/user_guide_src/source/changelogs/v4.6.5.rst b/user_guide_src/source/changelogs/v4.6.5.rst
@@ -31,6 +31,7 @@ Bugs Fixed
 **********
 
 - **Database:** Fixed a bug where ``Seeder::call()`` did not pass the database connection to child seeders, causing them to use the default connection instead of the one specified via ``Database::seeder('group')``.
+- **HTTP:** Updated the Content Security Policy nonce generation to use base64 encoding instead of hexadecimal, ensuring compatibility with CSP specifications.
 
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_

Original file line number	Diff line number	Diff line change
`@@ -303,7 +303,7 @@ public function enabled(): bool`
`303`	`303`	`public function getStyleNonce(): string`
`304`	`304`	`{`
`305`	`305`	`if ($this->styleNonce === null) {`
`306`		`- $this->styleNonce = bin2hex(random_bytes(12));`
	`306`	`+ $this->styleNonce = base64_encode(random_bytes(12));`
`307`	`307`	`$this->styleSrc[] = 'nonce-' . $this->styleNonce;`
`308`	`308`	`}`
`309`	`309`
`@@ -316,7 +316,7 @@ public function getStyleNonce(): string`
`316`	`316`	`public function getScriptNonce(): string`
`317`	`317`	`{`
`318`	`318`	`if ($this->scriptNonce === null) {`
`319`		`- $this->scriptNonce = bin2hex(random_bytes(12));`
	`319`	`+ $this->scriptNonce = base64_encode(random_bytes(12));`
`320`	`320`	`$this->scriptSrc[] = 'nonce-' . $this->scriptNonce;`
`321`	`321`	`}`
`322`	`322`
Original file line number	Diff line number	Diff line change
`@@ -578,18 +578,20 @@ public function testGetScriptNonce(): void`
`578`	`578`	`{`
`579`	`579`	`$this->prepare();`
`580`	`580`
`581`		`- $nonce = $this->csp->getScriptNonce();`
`582`		`-`
`583`		`- $this->assertMatchesRegularExpression('/\A[0-9a-z]{24}\z/', $nonce);`
	`581`	`+ $this->assertMatchesRegularExpression(`
	`582`	`+ '/\A[a-zA-Z0-9+\/-_]+[=]{0,2}\z/',`
	`583`	`+ $this->csp->getScriptNonce(),`
	`584`	`+ );`
`584`	`585`	`}`
`585`	`586`
`586`	`587`	`public function testGetStyleNonce(): void`
`587`	`588`	`{`
`588`	`589`	`$this->prepare();`
`589`	`590`
`590`		`- $nonce = $this->csp->getStyleNonce();`
`591`		`-`
`592`		`- $this->assertMatchesRegularExpression('/\A[0-9a-z]{24}\z/', $nonce);`
	`591`	`+ $this->assertMatchesRegularExpression(`
	`592`	`+ '/\A[a-zA-Z0-9+\/-_]+[=]{0,2}\z/',`
	`593`	`+ $this->csp->getStyleNonce(),`
	`594`	`+ );`
`593`	`595`	`}`
`594`	`596`
`595`	`597`	`#[PreserveGlobalState(false)]`
Original file line number	Diff line number	Diff line change
`@@ -493,7 +493,7 @@ public function testSafeMailtoWithCsp(): void`
`493`	`493`
`494`	`494`	`$html = safe_mailto('foo@example.jp', 'Foo');`
`495`	`495`
`496`		`- $this->assertMatchesRegularExpression('/<script .?nonce="\w+?".?>/u', $html);`
	`496`	`+ $this->assertMatchesRegularExpression('/<script .?nonce="[a-zA-Z0-9+\/]+[=]{0,2}".?>/u', $html);`
`497`	`497`	`}`
`498`	`498`
`499`	`499`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,7 @@ public function testAttachHoneypotAndContainerWithCSP(): void`
`107`	`107`	`$this->response->setBody('<head></head><body><form></form></body>');`
`108`	`108`	`$this->honeypot->attachHoneypot($this->response);`
`109`	`109`
`110`		`- $regex = '!<head><style nonce="[0-9a-f]+">#hpc { display:none }</style></head><body><form><div style="display:none" id="hpc"><label>Fill This Field</label><input type="text" name="honeypot" value=""></div></form></body>!u';`
	`110`	`+ $regex = '!<head><style nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}">#hpc { display:none }</style></head><body><form><div style="display:none" id="hpc"><label>Fill This Field</label><input type="text" name="honeypot" value=""></div></form></body>!u';`
`111`	`111`	`$this->assertMatchesRegularExpression($regex, $this->response->getBody());`
`112`	`112`	`}`
`113`	`113`
Original file line number	Diff line number	Diff line change
`@@ -151,7 +151,7 @@ public function testCspScriptNonceWithCspEnabled(): void`
`151`	`151`	`$template = 'aaa {+ csp_script_nonce +} bbb';`
`152`	`152`
`153`	`153`	`$this->assertMatchesRegularExpression(`
`154`		`- '/aaa nonce="[0-9a-z]{24}" bbb/',`
	`154`	`+ '/aaa nonce="[a-zA-Z0-9+\/-_]+[=]{0,2}" bbb/',`
`155`	`155`	`$this->parser->renderString($template),`
`156`	`156`	`);`
`157`	`157`	`}`