Skip to content

Instantly share code, notes, and snippets.

@JamoCA
Last active June 5, 2020 20:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JamoCA/fa176f86448b28bf4c48a60ca2a35d7d to your computer and use it in GitHub Desktop.
Save JamoCA/fa176f86448b28bf4c48a60ca2a35d7d to your computer and use it in GitHub Desktop.
Use ColdFusion & regex to remove "nonce" attributes from HTML
<!--- 20200605 Use ColdFusion & regex to remove "nonce" attributes from HTML
TryCF: https://trycf.com/gist/fa176f86448b28bf4c48a60ca2a35d7d
--->
<CFSAVECONTENT VARIABLE="HTML">
<script nonce="dXpwbUZDZjVPQnN1dVhGS1kzS0M2dz09">alert('script with nonce');</script>
<script nonce="">alert('script with empty none');</script>
<script>alert('script without nonce');</script>
</CFSAVECONTENT>
<cfscript>
string function removeNonce(required string HTML){
return javacast("string", arguments.HTML).replaceAll('(?i)\s+nonce\=(\"|\'').*?{32,}(\"|\'')', '');
}
</cfscript>
<cfoutput>
<h2>HTML</h2>
<textarea style="width:95%; height:100px;">#HTML#</textarea>
<h2>Sanitized HTML (no-Nonce)</h2>
<textarea style="width:95%; height:100px;">#removeNonce(HTML)#</textarea>
</cfoutput>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment