Allow nonce in reCaptcha

flask_wtf/recaptcha/fields.py

@@ -11,7 +11,10 @@ class RecaptchaField(Field):
 
     # error message if recaptcha validation fails
     recaptcha_error = None
+    # nonce
+    nonce = None
 
-    def __init__(self, label='', validators=None, **kwargs):
+    def __init__(self, label='', validators=None, nonce=None, **kwargs):
         validators = validators or [Recaptcha()]
+        self.nonce = nonce
         super(RecaptchaField, self).__init__(label, validators, **kwargs)

flask_wtf/recaptcha/widgets.py

@@ -6,8 +6,9 @@
 JSONEncoder = json.JSONEncoder
 
 RECAPTCHA_SCRIPT = u'https://www.google.com/recaptcha/api.js'
+RECAPTCHA_NONCE = u' nonce="%s"'
 RECAPTCHA_TEMPLATE = u'''
-<script src='%s' async defer></script>
+<script src='%s' async defer%s></script>
 <div class="g-recaptcha" %s></div>
 '''
 
@@ -16,7 +17,7 @@
 
 class RecaptchaWidget(object):
 
-    def recaptcha_html(self, public_key):
+    def recaptcha_html(self, public_key, nonce=None):
         html = current_app.config.get('RECAPTCHA_HTML')
         if html:
             return Markup(html)
@@ -25,10 +26,14 @@ def recaptcha_html(self, public_key):
         if params:
             script += u'?' + url_encode(params)
 
+        nonce_attr = ''
+        if nonce is not None:
+            nonce_attr = RECAPTCHA_NONCE % nonce
+
         attrs = current_app.config.get('RECAPTCHA_DATA_ATTRS', {})
         attrs['sitekey'] = public_key
         snippet = u' '.join([u'data-%s="%s"' % (k, attrs[k]) for k in attrs])
-        return Markup(RECAPTCHA_TEMPLATE % (script, snippet))
+        return Markup(RECAPTCHA_TEMPLATE % (script, nonce_attr, snippet))
 
     def __call__(self, field, error=None, **kwargs):
         """Returns the recaptcha input HTML."""
@@ -38,4 +43,4 @@ def __call__(self, field, error=None, **kwargs):
         except KeyError:
             raise RuntimeError('RECAPTCHA_PUBLIC_KEY config not set')
 
-        return self.recaptcha_html(public_key)
+        return self.recaptcha_html(public_key, nonce=field.nonce)

tests/test_recaptcha.py

@@ -15,6 +15,13 @@ class Meta:
     recaptcha = RecaptchaField()
 
 
+class RecaptchaNonceForm(FlaskForm):
+    class Meta:
+        csrf = False
+
+    recaptcha = RecaptchaField(nonce='foobar')
+
+
 @pytest.fixture
 def app(app):
     app.testing = False
@@ -53,6 +60,12 @@ def test_render_has_js():
     assert 'https://www.google.com/recaptcha/api.js' in render
 
 
+def test_render_has_nonce():
+    f = RecaptchaNonceForm()
+    render = f.recaptcha()
+    assert 'nonce="foobar"' in render
+
+
 def test_render_custom_html(app):
     app.config['RECAPTCHA_HTML'] = 'custom'
     f = RecaptchaForm()