New. Settings. Add CSP nonce support.

[svfcode]

task https://app.doboard.com/1/task/55651

[codecov]

Codecov Report

❌ Patch coverage is 27.90698% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 29.56%. Comparing base (d9bcedf) to head (b4c40da).

Files with missing lines	Patch %	Lines
inc/cleantalk-public.php	0.00%	16 Missing ⚠️
inc/cleantalk-pluggable.php	40.00%	9 Missing ⚠️
...k/Antispam/Integrations/CleantalkExternalForms.php	0.00%	3 Missing ⚠️
cleantalk.php	0.00%	2 Missing ⚠️
lib/Cleantalk/ApbctWP/Firewall/AntiCrawler.php	0.00%	1 Missing ⚠️

❌ Your patch check has failed because the patch coverage (27.90%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##                fix     #868      +/-   ##
============================================
+ Coverage     29.52%   29.56%   +0.03%     
  Complexity     6493     6493              
============================================
  Files           289      289              
  Lines         26202    26233      +31     
============================================
+ Hits           7736     7755      +19     
- Misses        18466    18478      +12     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds CSP nonce support for CleanTalk’s inline <script> output by introducing a nonce provider/filter and routing various inline-script emitters through a shared helper.

Changes:

• Introduces apbct_get_csp_nonce(), apbct_get_inline_script_tag(), and apbct_get_inline_script_kses() to centralize inline-script generation and nonce injection.
• Refactors multiple inline script outputs (public localize blocks, external forms, antibot cookie setter, footer hooks, etc.) to use the new helper.
• Adds PHPUnit coverage validating nonce propagation into generated script tags.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/ApbctWP/TestCspNonce.php	Adds tests for nonce injection into inline script tags and localize output.
lib/Cleantalk/Common/ContactsEncoder/Helper/ContactsEncoderAssetsHelper.php	Switches contacts-encoder inline JS output to the shared inline-script helper.
lib/Cleantalk/ApbctWP/Localize/CtPublicLocalize.php	Uses shared inline-script helper to generate localized ctPublic script tag with attributes and nonce support.
lib/Cleantalk/ApbctWP/Localize/CtPublicFunctionsLocalize.php	Uses shared inline-script helper to generate localized ctPublicFunctions script tag with attributes and nonce support.
lib/Cleantalk/ApbctWP/Firewall/AntiCrawler.php	Uses shared inline-script helper for the antibot cookie setter inline script.
lib/Cleantalk/Antispam/Integrations/CleantalkExternalForms.php	Uses shared inline-script helper for the external-form clearing/submit script and Cookiebot attribute handling.
inc/cleantalk-public.php	Uses shared inline-script helper + centralized kses allowlist for footer/hidden-field inline scripts (including nonce).
inc/cleantalk-pluggable.php	Adds CSP nonce filter accessor, inline-script tag generator, and kses allowlist helper.
cleantalk.php	Updates a specific integration hook to output inline JS via the shared helper (nonce-capable).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

lib/Cleantalk/ApbctWP/Localize/CtPublicFunctionsLocalize.php:46

• apbct_get_inline_script_tag() may render boolean attributes differently depending on whether it uses wp_get_inline_script_tag() or the fallback implementation. To avoid WP-version-dependent output, use a string value for data-pagespeed-no-defer instead of true.

                'data-pagespeed-no-defer' => true,

lib/Cleantalk/ApbctWP/Localize/CtPublicLocalize.php:59

• apbct_get_inline_script_tag() has two rendering paths: it either delegates to wp_get_inline_script_tag() (newer WP) or uses the plugin fallback. In the fallback, a boolean true attribute is rendered as a valueless attribute (e.g. data-pagespeed-no-defer), while the WordPress helper may serialize booleans differently. To keep the generated markup stable across WP versions, pass a string value instead of true here.

                'data-pagespeed-no-defer' => true,