Also inject nonce in script tags without attributes

manisandro · manisandro · commit 0ec68e301055 · 2025-10-09T10:45:57.000+02:00
diff --git a/src/qwc2_viewer.py b/src/qwc2_viewer.py
@@ -218,6 +218,7 @@ def qwc2_index(self, identity, params, request_url):
             csp += "; " + self.extra_csp_directives
         viewer_index = viewer_index.replace('<head>', '<head>\n<meta http-equiv="Content-Security-Policy" content="%s">' % csp)
         viewer_index = viewer_index.replace('<script ', '<script nonce="%s" ' % nonce)
+        viewer_index = viewer_index.replace('<script>', '<script nonce="%s">' % nonce)
 
         return viewer_index
 
