Add abp-csp-loader script if UseContentSecurityPolicyNonce is true

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/Contributors/AbpPreloadStyleLoadScriptContributor.cs

@@ -1,11 +0,0 @@
-using System.Collections.Generic;
-
-namespace Volo.Abp.AspNetCore.Mvc.UI.Bundling.Contributors;
-
-public class AbpPreloadStyleLoadScriptContributor : BundleContributor
-{
-    public override void ConfigureBundle(BundleConfigurationContext context)
-    {
-        context.Files.AddIfNotContains("/libs/abp/aspnetcore-mvc-ui-theme-shared/csp/preload-style-load.js");
-    }
-}

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperStyleService.cs

@@ -8,19 +8,23 @@ using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.Razor.TagHelpers;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Options;
+using Volo.Abp.AspNetCore.Security;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bundling.TagHelpers;
 
 public class AbpTagHelperStyleService : AbpTagHelperResourceService
 {
+    private readonly IOptions<AbpSecurityHeadersOptions> _securityHeadersOptions;
     public AbpTagHelperStyleService(
         IBundleManager bundleManager,
         IOptions<AbpBundlingOptions> options,
-        IWebHostEnvironment hostingEnvironment) : base(
+        IWebHostEnvironment hostingEnvironment, 
+        IOptions<AbpSecurityHeadersOptions> securityHeadersOptions) : base(
             bundleManager,
             options,
             hostingEnvironment)
     {
+        _securityHeadersOptions = securityHeadersOptions;
     }
 
     protected override void CreateBundle(string bundleName, List<BundleTagHelperItem> bundleItems)
@@ -48,7 +52,9 @@ public class AbpTagHelperStyleService : AbpTagHelperResourceService
 
         if (preload || Options.PreloadStylesByDefault || Options.PreloadStyles.Any(x => file.StartsWith(x, StringComparison.OrdinalIgnoreCase)))
         {
-            output.Content.AppendHtml($"<link rel=\"preload\" href=\"{viewContext.GetUrlHelper().Content(file.EnsureStartsWith('~'))}\" as=\"style\" onload=\"this.rel='stylesheet'\" />{Environment.NewLine}");
+            output.Content.AppendHtml(_securityHeadersOptions.Value.UseContentSecurityPolicyNonce
+                ? $"<link rel=\"preload\" href=\"{viewContext.GetUrlHelper().Content(file.EnsureStartsWith('~'))}\" as=\"style\" abp-csp-style />{Environment.NewLine}"
+                : $"<link rel=\"preload\" href=\"{viewContext.GetUrlHelper().Content(file.EnsureStartsWith('~'))}\" as=\"style\" onload=\"this.rel='stylesheet'\" />{Environment.NewLine}");
         }
         else
         {

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared/Bundling/SharedThemeGlobalScriptContributor.cs

@@ -1,4 +1,7 @@
-using Volo.Abp.AspNetCore.Mvc.UI.Bundling;
+using System.Collections.Generic;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Volo.Abp.AspNetCore.Mvc.UI.Bundling;
 using Volo.Abp.AspNetCore.Mvc.UI.Packages.Bootstrap;
 using Volo.Abp.AspNetCore.Mvc.UI.Packages.BootstrapDatepicker;
 using Volo.Abp.AspNetCore.Mvc.UI.Packages.BootstrapDaterangepicker;
@@ -13,6 +16,7 @@ using Volo.Abp.AspNetCore.Mvc.UI.Packages.Select2;
 using Volo.Abp.AspNetCore.Mvc.UI.Packages.SweetAlert2;
 using Volo.Abp.AspNetCore.Mvc.UI.Packages.Timeago;
 using Volo.Abp.AspNetCore.Mvc.UI.Packages.Toastr;
+using Volo.Abp.AspNetCore.Security;
 using Volo.Abp.Modularity;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Bundling;
@@ -35,6 +39,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Bundling;
     )]
 public class SharedThemeGlobalScriptContributor : BundleContributor
 {
+    
     public override void ConfigureBundle(BundleConfigurationContext context)
     {
         context.Files.AddRange(new[]
@@ -49,5 +54,10 @@ public class SharedThemeGlobalScriptContributor : BundleContributor
                 "/libs/abp/aspnetcore-mvc-ui-theme-shared/sweetalert2/abp-sweetalert2.js",
                 "/libs/abp/aspnetcore-mvc-ui-theme-shared/toastr/abp-toastr.js"
             });
+
+        if (context.ServiceProvider.GetRequiredService<IOptions<AbpSecurityHeadersOptions>>().Value.UseContentSecurityPolicyNonce)
+        {
+            context.Files.AddIfNotContains("/libs/abp/aspnetcore-mvc-ui-theme-shared/csp/abp-csp-style-loader.js");
+        }
     }
 }

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared/wwwroot/libs/abp/aspnetcore-mvc-ui-theme-shared/csp/preload-style-load.js → framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared/wwwroot/libs/abp/aspnetcore-mvc-ui-theme-shared/csp/abp-csp-style-loader.js

@@ -1,4 +1,4 @@
 $(function (){
-    let preLoads = $("link[rel=preload][as=style]");
+    let preLoads = $("link[abp-csp-style]");
     preLoads.attr("rel", "stylesheet");
 })