From 4dbd81468a80335e3ac9d3b4380599fc774c1b91 Mon Sep 17 00:00:00 2001
From: andrezarzur <andrezarzur@hotmail.com>
Date: Thu, 5 Sep 2024 10:26:30 -0300
Subject: [PATCH 1/4] feat: adding nonce option for wavesurfer config

---
 src/renderer.ts   | 4 +++-
 src/wavesurfer.ts | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/renderer.ts b/src/renderer.ts
index f08b56e91..763545381 100644
--- a/src/renderer.ts
+++ b/src/renderer.ts
@@ -169,8 +169,10 @@ class Renderer extends EventEmitter<RendererEvents> {
     const div = document.createElement('div')
     const shadow = div.attachShadow({ mode: 'open' })
 
+    const nonce = this.options.nonce;
+
     shadow.innerHTML = `
-      <style>
+      <style ${nonce ? `nonce="${nonce}"` : ''}>
         :host {
           user-select: none;
           min-width: 1px;
diff --git a/src/wavesurfer.ts b/src/wavesurfer.ts
index a3c409f99..de653148f 100644
--- a/src/wavesurfer.ts
+++ b/src/wavesurfer.ts
@@ -76,6 +76,8 @@ export type WaveSurferOptions = {
   fetchParams?: RequestInit
   /** Playback "backend" to use, defaults to MediaElement */
   backend?: 'WebAudio' | 'MediaElement'
+  /** Nonce for CSP if necessary */
+  nonce?: string
 }
 
 const defaultOptions = {

From da5db440e12dcf12a75b3c86550202dad59b7fdf Mon Sep 17 00:00:00 2001
From: andrezarzur <andrezarzur@hotmail.com>
Date: Thu, 5 Sep 2024 10:50:44 -0300
Subject: [PATCH 2/4] fix: adding prepare script to build on install

---
 package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ce68f0c9d..064cf4e94 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,8 @@
     "cypress:canary": "cypress open --e2e -b chrome:canary",
     "test": "cypress run --browser chrome",
     "serve": "npx live-server --port=9090 --no-browser --ignore='.*,src,cypress,scripts'",
-    "start": "npm run build:dev & npm run serve"
+    "start": "npm run build:dev & npm run serve",
+    "prepare": "npm run build"
   },
   "devDependencies": {
     "@rollup/plugin-terser": "^0.4.4",

From d875275e3f9cdf108db9b9ed972ad194ab120531 Mon Sep 17 00:00:00 2001
From: andrezarzur <andrezarzur@hotmail.com>
Date: Thu, 5 Sep 2024 11:12:44 -0300
Subject: [PATCH 3/4] fix: removing the prepare script to be able to create the
 pull request

---
 package.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 064cf4e94..ce68f0c9d 100644
--- a/package.json
+++ b/package.json
@@ -66,8 +66,7 @@
     "cypress:canary": "cypress open --e2e -b chrome:canary",
     "test": "cypress run --browser chrome",
     "serve": "npx live-server --port=9090 --no-browser --ignore='.*,src,cypress,scripts'",
-    "start": "npm run build:dev & npm run serve",
-    "prepare": "npm run build"
+    "start": "npm run build:dev & npm run serve"
   },
   "devDependencies": {
     "@rollup/plugin-terser": "^0.4.4",

From 663446ffa78ba7acf651af3bc2a2c52fb78802f3 Mon Sep 17 00:00:00 2001
From: andrezarzur <andrezarzur@hotmail.com>
Date: Fri, 6 Sep 2024 14:42:25 -0300
Subject: [PATCH 4/4] fix: making XSS adjustments

---
 src/renderer.ts   | 4 ++--
 src/wavesurfer.ts | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/renderer.ts b/src/renderer.ts
index 763545381..914b4838b 100644
--- a/src/renderer.ts
+++ b/src/renderer.ts
@@ -169,10 +169,10 @@ class Renderer extends EventEmitter<RendererEvents> {
     const div = document.createElement('div')
     const shadow = div.attachShadow({ mode: 'open' })
 
-    const nonce = this.options.nonce;
+    const cspNonce = this.options.cspNonce && typeof this.options.cspNonce === 'string' ? this.options.cspNonce.replace(/"/g, '') : '';
 
     shadow.innerHTML = `
-      <style ${nonce ? `nonce="${nonce}"` : ''}>
+      <style${cspNonce ? ` nonce="${cspNonce}"` : ''}>
         :host {
           user-select: none;
           min-width: 1px;
diff --git a/src/wavesurfer.ts b/src/wavesurfer.ts
index de653148f..ecc2c4290 100644
--- a/src/wavesurfer.ts
+++ b/src/wavesurfer.ts
@@ -77,7 +77,7 @@ export type WaveSurferOptions = {
   /** Playback "backend" to use, defaults to MediaElement */
   backend?: 'WebAudio' | 'MediaElement'
   /** Nonce for CSP if necessary */
-  nonce?: string
+  cspNonce?: string
 }
 
 const defaultOptions = {