solidjs / solid / 37065845374

76%

main: 89%

push

github

fix(web): stylesheet-gated fragments reveal under a nonce CSP and when a sheet loads early (#3755)

* fix(web): stylesheet-gated fragments reveal under a nonce CSP and when a sheet loads early

A fragment whose boundary streamed stylesheet links waited on inline
`onload`/`onerror` handlers. Those can't carry a nonce, so under a strict
`script-src` CSP the gate never released and the boundary stayed on its
fallback. The links now carry `data-dfc`, and the fragment helpers install
one capture-phase `load`/`error` listener, from the nonce-carrying task
script, that counts each link down once.

The links were also written ahead of the content template. A sheet that
loads before the parser reaches the template (a cached sheet, or a chunk
boundary between the two) ran `$dfc` while the template was missing, and
`$dfr` treats a missing template as a swap that already ran, so the reveal
was dropped. The template now goes first.

Fixes #3747

* test(web): remove the stylesheet gate spec's document listeners between tests

Each test evaluates the stream helpers, which install their capture-phase
listener on the shared jsdom document. Record and remove them so a test only
sees listeners its own scripts added, which is what the count-once test means
to exercise.

Co-authored-by: Claude via Cursor <noreply@cursor.com>

---------

Co-authored-by: Ryan Carniato <ryansolid@gmail.com>
Co-authored-by: Claude via Cursor <noreply@cursor.com>

649 of 925 branches covered (70.16%)

Branch coverage included in aggregate %.

962 of 1195 relevant lines covered (80.5%)

27.95 hits per line