react-spectrum

dc3cbd54 - feat: support CSP nonce on injected style elements (#9655)

feat: support CSP nonce on injected style elements (#9655) * feat: support CSP nonce on dynamically injected style elements Add getNonce() utility that reads CSP nonce from <meta property="csp-nonce"> or __webpack_nonce__, and apply it to <style> elements injected by usePress and usePreventScroll. This fixes CSP violations when a strict style-src directive is in effect. Fixes #8273 * fix: add globalThis ESLint global to getNonce test file The .js test file was missing globalThis in ESLint globals since the TypeScript config block (which declares it) only applies to .ts/.tsx files. This resolves the no-undef lint failure. * fix: use type guard, cache nonce, and add globalThis ESLint global Address review feedback: - Replace type cast with instanceof type guard via getOwnerWindow - Cache nonce result for repeated calls without explicit doc arg - Add globalThis to ESLint globals to fix lint failure * fix: reset nonce cache between tests Add resetNonceCache() export and call it in afterEach to prevent cached values from leaking across test runs. * fix: remove redundant globalThis inline global directive globalThis is already declared in eslint.config.mjs globals, so the /* global globalThis */ comment triggers no-redeclare. * fix: use WeakMap for nonce caching to support multiple documents - Replace module-level cache with WeakMap<Document, string | undefined> so each document gets its own cached nonce (supports iframes) - Remove resetNonceCache from public API (only needed for tests) - Import resetNonceCache directly from source in test file * fix: remove redundant optional chaining and add comprehensive tests Remove unnecessary ?. operators after null guard in getNonce, and add tests for nonce/content priority, caching behavior, cache reset, empty string handling, and content fallback. * fix: check document window for __webpack_nonce__ and don't cache misses Extract getWebpackNonce() helper that checks the document's owning window before falling back to globalThis, supporting iframe scenarios. Only cache defined nonce values so late-arriving nonces are detected. Add tests for no-cache-on-miss, late meta detection, and per-window webpack nonce resolution.