From 905e0c8d62c67e964b9b47b5727472de6b55f477 Mon Sep 17 00:00:00 2001
From: ost-ptk <ostap@make.services>
Date: Tue, 28 Jul 2026 12:10:57 +0300
Subject: [PATCH] build: emit the CSP nonce only for Chrome production builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The nonce was generated per build and injected via DefinePlugin for every
browser target, although only the Chrome-production CSP arm pins style-src to
it. Both readers are browser-agnostic, so every Firefox and Safari bundle
carried a fresh random base64 literal that nothing used — and AMO source review
rebuilds the submitted source and compares the artifact byte for byte, which a
per-build random literal makes impossible.

The DefinePlugin key stays defined for all targets on purpose: nothing else
defines `process` in these bundles, so dropping the key would leave
process.env.CSP_NONCE unreplaced and throw ReferenceError at runtime. Only the
value becomes null off the Chrome-production path, and both readers now skip the
attribute entirely rather than stamping nonce="null".

Deriving the nonce from the commit hash was considered and rejected: a publicly
computable nonce adds nothing over a static one, while gating removes the value
from the non-Chrome bundles altogether.

Verified: two consecutive build:firefox runs are byte-identical after this
change and differed before it; build/chrome still carries a real nonce in its
manifest CSP.
---
 src/libs/ui/style-sheet-manager.tsx |  2 +-
 src/set-webpack-nonce.ts            | 17 +++++++++++------
 webpack.config.js                   | 14 +++++++++-----
 3 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/libs/ui/style-sheet-manager.tsx b/src/libs/ui/style-sheet-manager.tsx
index fdb94d4f6..2899aaa2d 100644
--- a/src/libs/ui/style-sheet-manager.tsx
+++ b/src/libs/ui/style-sheet-manager.tsx
@@ -11,7 +11,7 @@ export const CspStyleSheetManager = ({ children }: PropsWithChildren) => (
     // styled-components stamps this nonce on its injected <style> tags so they pass the
     // Chrome-prod `style-src 'self' 'nonce-<value>'` CSP; value comes from webpack DefinePlugin
     // (inert on dev + Firefox/Safari, whose CSP keeps 'unsafe-inline'). See webpack.config.js.
-    nonce={process.env.CSP_NONCE}
+    nonce={process.env.CSP_NONCE ?? undefined}
   >
     {children}
   </StyleSheetManager>
diff --git a/src/set-webpack-nonce.ts b/src/set-webpack-nonce.ts
index f04b61852..33ae2c4b5 100644
--- a/src/set-webpack-nonce.ts
+++ b/src/set-webpack-nonce.ts
@@ -2,9 +2,14 @@
 // <style> tags with the build-time CSP nonce (Chrome prod style-src is
 // 'self' 'nonce-<value>' with no 'unsafe-inline'). Must be imported FIRST in every
 // app entry, before any style-loader CSS import or styled-components injection runs.
-declare let __webpack_nonce__: string;
-// Ambient webpack global: style-loader's runtime reads it off the global scope (not
-// from this module), so ESLint can't see the "use", and it must stay `let` since it's
-// assigned after declaration rather than initialized inline.
-// eslint-disable-next-line prefer-const, @typescript-eslint/no-unused-vars
-__webpack_nonce__ = process.env.CSP_NONCE as string;
+declare let __webpack_nonce__: string | undefined;
+const nonce = process.env.CSP_NONCE;
+// Only Chrome-production defines a nonce; elsewhere style-src keeps
+// 'unsafe-inline' and style-loader must not stamp a `nonce="null"`.
+if (nonce) {
+  // Ambient webpack global: style-loader's runtime reads it off the global scope (not
+  // from this module), so ESLint can't see the "use", and it must stay `let` since it's
+  // assigned after declaration rather than initialized inline.
+  // eslint-disable-next-line prefer-const, @typescript-eslint/no-unused-vars
+  __webpack_nonce__ = nonce;
+}
diff --git a/webpack.config.js b/webpack.config.js
index 6c8ac5998..0043212fd 100755
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -64,11 +64,15 @@ if (fileSystem.existsSync(secretsPath)) {
   alias['secrets'] = secretsPath;
 }
 
-// One nonce per build. Chrome-production style-src pins to it instead of
-// 'unsafe-inline'; the same value is wired to __webpack_nonce__ (style-loader)
-// and process.env.CSP_NONCE (styled-components' CspStyleSheetManager) below,
-// so the manifest CSP and the injected <style> tags always match.
-const CSP_NONCE = crypto.randomBytes(16).toString('base64');
+// One nonce per build, and ONLY for Chrome production — that is the sole CSP arm
+// that pins style-src to it (see getCSP below). Emitting a random literal into
+// Firefox/Safari bundles that never read it makes those builds irreproducible,
+// which AMO source review requires (it rebuilds and compares byte-for-byte).
+// Where it does apply, the same value is wired to __webpack_nonce__ (style-loader)
+// and process.env.CSP_NONCE (styled-components' CspStyleSheetManager) below, so
+// the manifest CSP and the injected <style> tags always match.
+const CSP_NONCE =
+  isChrome && !isDev ? crypto.randomBytes(16).toString('base64') : null;
 
 const getCSP = () => {
   // Chrome-production locks <style>/<link> ELEMENTS to the build nonce (style-src,