MYFACES-4748 / MYFACES-4747: CSP script rendering

Author: tandraschko

impl/src/main/java/org/apache/myfaces/context/servlet/PartialViewContextImpl.java

@@ -59,6 +59,7 @@
 import org.apache.myfaces.context.PartialResponseWriterImpl;
 import org.apache.myfaces.context.RequestViewContext;
 import org.apache.myfaces.renderkit.html.HtmlResponseStateManager;
+import org.apache.myfaces.renderkit.html.util.CommonHtmlEventsUtil;
 import org.apache.myfaces.renderkit.html.util.ResourceUtils;
 import org.apache.myfaces.util.lang.StringUtils;
 import org.apache.myfaces.component.visit.MyFacesVisitHints;
@@ -572,6 +573,8 @@ else if (viewRoot.isTransient())
                 writer.writeText(cw.getId(), null);
                 writer.endUpdate();
             }
+
+            CommonHtmlEventsUtil.flushDeferredCspBehaviorScripts(context, writer);
         }
         catch (IOException ex)
         {

impl/src/main/java/org/apache/myfaces/renderkit/html/HtmlResponseWriterImpl.java

@@ -35,6 +35,7 @@
 import jakarta.faces.render.Renderer;
 
 import org.apache.myfaces.config.webparameters.MyfacesConfig;
+import org.apache.myfaces.renderkit.html.util.CommonHtmlEventsUtil;
 import org.apache.myfaces.core.api.shared.ComponentUtils;
 import org.apache.myfaces.renderkit.ContentTypeUtils;
 import org.apache.myfaces.renderkit.html.util.UnicodeEncoder;
@@ -306,6 +307,7 @@ public void startDocument()
     public void endDocument() throws IOException
     {
         FacesContext facesContext = getFacesContext();
+        CommonHtmlEventsUtil.flushDeferredCspBehaviorScripts(facesContext, this);
         MyfacesConfig myfacesConfig = MyfacesConfig.getCurrentInstance(facesContext);
         if (myfacesConfig.isEarlyFlushEnabled())
         {

impl/src/main/java/org/apache/myfaces/renderkit/html/base/HtmlBodyRendererBase.java

@@ -158,6 +158,8 @@ public void encodeEnd(FacesContext facesContext, UIComponent component) throws I
                 child.encodeAll(facesContext);
             }
         }
+
+        CommonHtmlEventsUtil.flushDeferredCspBehaviorScripts(facesContext, writer);
 
         // render all unhandled FacesMessages when ProjectStage is Development
         if (facesContext.isProjectStage(ProjectStage.Development))

impl/src/main/java/org/apache/myfaces/renderkit/html/base/HtmlButtonRendererBase.java

@@ -44,6 +44,7 @@
 
 import org.apache.myfaces.renderkit.ClientBehaviorEvents;
 import org.apache.myfaces.renderkit.RendererUtils;
+import org.apache.myfaces.renderkit.html.util.CommonHtmlEventsUtil;
 import org.apache.myfaces.renderkit.html.util.JavascriptUtils;
 import org.apache.myfaces.renderkit.html.util.ResourceUtils;
 import org.apache.myfaces.renderkit.html.util.HTML;
@@ -187,7 +188,11 @@ public void encodeBegin(FacesContext facesContext, UIComponent uiComponent) thro
                         form, validParams);
                 if (onClick.length() != 0)
                 {
-                    writer.writeAttribute(HTML.ONCLICK_ATTR, onClick, null);
+                    if (!CommonHtmlEventsUtil.deferClientBehaviorScriptIfCspNonceActive(
+                            facesContext, clientId, HTML.ONCLICK_ATTR, onClick))
+                    {
+                        writer.writeAttribute(HTML.ONCLICK_ATTR, onClick, null);
+                    }
                 }
             }
             else
@@ -201,7 +206,11 @@ public void encodeBegin(FacesContext facesContext, UIComponent uiComponent) thro
                         commandOnclick , null);
                 if (onClick.length() != 0)
                 {
-                    writer.writeAttribute(HTML.ONCLICK_ATTR, onClick, null);
+                    if (!CommonHtmlEventsUtil.deferClientBehaviorScriptIfCspNonceActive(
+                            facesContext, clientId, HTML.ONCLICK_ATTR, onClick))
+                    {
+                        writer.writeAttribute(HTML.ONCLICK_ATTR, onClick, null);
+                    }
                 }
             }
 

impl/src/main/java/org/apache/myfaces/renderkit/html/base/HtmlLinkRendererBase.java

@@ -549,7 +549,14 @@ protected void renderBehaviorizedJavaScriptAnchorStart(FacesContext facesContext
 
         writer.startElement(HTML.ANCHOR_ELEM, component);
         writer.writeURIAttribute(HTML.HREF_ATTR, "#", null);
-        writer.writeAttribute(HTML.ONCLICK_ATTR, onclick, null);
+        if (onclick != null && !onclick.isEmpty())
+        {
+            if (!CommonHtmlEventsUtil.deferClientBehaviorScriptIfCspNonceActive(
+                    facesContext, clientId, HTML.ONCLICK_ATTR, onclick))
+            {
+                writer.writeAttribute(HTML.ONCLICK_ATTR, onclick, null);
+            }
+        }
     }
 
     private boolean hasSubmittingBehavior(Map<String, List<ClientBehavior>> clientBehaviors, String eventName)