Skip to content

Commit

Permalink
fix: csp nonce injection when no closing tag (#16281) (#16282)
Browse files Browse the repository at this point in the history
Co-authored-by: 翠 / green <[email protected]>
  • Loading branch information
gregtwallace and sapphi-red authored Mar 31, 2024
1 parent f1e67b6 commit 3c85c6b
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion packages/vite/src/node/plugins/html.ts
Original file line number Diff line number Diff line change
Expand Up @@ -1189,8 +1189,13 @@ export function injectNonceAttributeTagHook(
parseRelAttr(attr.value).some((a) => processRelType.has(a)),
))
) {
// if the closing of the start tag includes a `/`, the offset should be 2 so the nonce
// is appended prior to the `/`
const appendOffset =
html[node.sourceCodeLocation!.startTag!.endOffset - 2] === '/' ? 2 : 1

s.appendRight(
node.sourceCodeLocation!.startTag!.endOffset - 1,
node.sourceCodeLocation!.startTag!.endOffset - appendOffset,
` nonce="${nonce}"`,
)
}
Expand Down

0 comments on commit 3c85c6b

Please sign in to comment.