[9.x] Add nonce for preloaded assets (#44747)

* fix: add nonce for preloaded assets

* formatting

* add tests

Co-authored-by: Tim MacDonald <[email protected]>

Author: joostdebruijn

src/Illuminate/Foundation/Vite.php

@@ -438,9 +438,11 @@ protected function resolvePreloadTagAttributes($src, $url, $chunk, $manifest)
             'rel' => 'preload',
             'as' => 'style',
             'href' => $url,
+            'nonce' => $this->nonce ?? false,
         ] : [
             'rel' => 'modulepreload',
             'href' => $url,
+            'nonce' => $this->nonce ?? false,
         ];
 
         $attributes = $this->integrityKey !== false

tests/Foundation/FoundationViteTest.php

@@ -846,6 +846,48 @@ public function testItCanSpecifyAttributesForPreloadedAssets()
         $this->cleanViteManifest($buildDir);
     }
 
+    public function testPreloadAssetsGetAssetNonce()
+    {
+        $buildDir = Str::random();
+        $this->makeViteManifest([
+            'resources/js/app.js' => [
+                'src' => 'resources/js/app.js',
+                'file' => 'assets/app.versioned.js',
+                'css' => [
+                    'assets/app.versioned.css',
+                ],
+            ],
+            'resources/css/app.css' => [
+                'src' => 'resources/css/app.css',
+                'file' => 'assets/app.versioned.css',
+            ],
+        ], $buildDir);
+        ViteFacade::useCspNonce('expected-nonce');
+
+        $result = app(Vite::class)(['resources/js/app.js'], $buildDir);
+
+        $this->assertSame(
+            '<link rel="preload" as="style" href="https://example.com/'.$buildDir.'/assets/app.versioned.css" nonce="expected-nonce" />'
+            .'<link rel="modulepreload" href="https://example.com/'.$buildDir.'/assets/app.versioned.js" nonce="expected-nonce" />'
+            .'<link rel="stylesheet" href="https://example.com/'.$buildDir.'/assets/app.versioned.css" nonce="expected-nonce" />'
+            .'<script type="module" src="https://example.com/'.$buildDir.'/assets/app.versioned.js" nonce="expected-nonce"></script>',
+        $result->toHtml());
+
+        $this->assertSame([
+            "https://example.com/$buildDir/assets/app.versioned.css" => [
+                'rel="preload"',
+                'as="style"',
+                'nonce="expected-nonce"',
+            ],
+            "https://example.com/$buildDir/assets/app.versioned.js" => [
+                'rel="modulepreload"',
+                'nonce="expected-nonce"',
+            ],
+        ], ViteFacade::preloadedAssets());
+
+        $this->cleanViteManifest($buildDir);
+    }
+
     protected function makeViteManifest($contents = null, $path = 'build')
     {
         app()->singleton('path.public', fn () => __DIR__);