diff --git a/src/write-stream.js b/src/write-stream.js index 4e84dd6d..6779a0a6 100644 --- a/src/write-stream.js +++ b/src/write-stream.js @@ -377,6 +377,17 @@ export default class WriteStream { } } + /** + * Sets nonce to scripts and style tags that are generated to support CSP + * + * @param {HTMLElement} el The script/style tag to be associated with nonce + */ + _setNonce(el) { + if (this.options.nonce) { + el.nonce = this.options.nonce; + } + } + /** * Build a style and insert it into the DOM. * @@ -384,7 +395,7 @@ export default class WriteStream { */ _writeStyleToken(tok) { const el = this._buildStyle(tok); - + this._setNonce(el); this._insertCursor(el, PROXY_STYLE); // Set content @@ -485,7 +496,7 @@ export default class WriteStream { const el = this._buildScript(tok); const asyncRelease = this._shouldRelease(el); const afterAsync = this.options.afterAsync; - + this._setNonce(el); if (tok.src) { // Fix for attribute "SRC" (capitalized). IE does not recognize it. el.src = tok.src;