fix: strf-11673 Wrap nonce into SafeString (#301)

bigcommerce · Mar 14, 2024 · 2580ddd · 2580ddd
1 parent 80059c0
commit 2580ddd
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/helpers/nonce.js b/helpers/nonce.js
@@ -4,7 +4,7 @@ const factory = globals => {
     return function() {
         const params = globals.getRequestParams();
         if (params && params.security && params.security.nonce) {
-            return ` nonce="${params.security.nonce}"`;
+            return new globals.handlebars.SafeString(` nonce="${params.security.nonce}"`);
         }
         return ''
     };

diff --git a/spec/helpers/nonce.js b/spec/helpers/nonce.js
@@ -17,7 +17,7 @@ describe('nonce helper', function () {
         runTestCases([
             {
                 input: '{{nonce}}',
-                output: ' nonce=&quot;' + requestParams.security.nonce + '&quot;',
+                output: ' nonce="' + requestParams.security.nonce + '"',
             },
         ], done);
     });