fix: CSP style nonce is added even if honeypot is not attached

kenjis · kenjis · commit 4892849941ef · 2023-10-10T16:50:46.000+09:00
The tag like this was added in &lt;head&gt; tag in every page.
&lt;style nonce="ccdd15247e8da0a5b9023a5e"&gt;#hpc { display:none }&lt;/style&gt;
diff --git a/system/Honeypot/Honeypot.php b/system/Honeypot/Honeypot.php
@@ -89,16 +89,16 @@ public function attachHoneypot(ResponseInterface $response)
 
         $prepField = $this->prepareTemplate($this->config->template);
 
-        $body = $response->getBody();
-        $body = str_ireplace('</form>', $prepField . '</form>', $body);
+        $bodyBefore = $response->getBody();
+        $bodyAfter  = str_ireplace('</form>', $prepField . '</form>', $bodyBefore);
 
-        if ($response->getCSP()->enabled()) {
+        if ($response->getCSP()->enabled() && ($bodyBefore !== $bodyAfter)) {
             // Add style tag for the container tag in the head tag.
-            $style = '<style ' . csp_style_nonce() . '>#' . $this->config->containerId . ' { display:none }</style>';
-            $body  = str_ireplace('</head>', $style . '</head>', $body);
+            $style     = '<style ' . csp_style_nonce() . '>#' . $this->config->containerId . ' { display:none }</style>';
+            $bodyAfter = str_ireplace('</head>', $style . '</head>', $bodyAfter);
         }
 
-        $response->setBody($body);
+        $response->setBody($bodyAfter);
     }
 
     /**
