fix: csp nonce injection when no closing tag (#16281) (#16282)

gregtwallace · sapphi-red · web-flow · commit 3c85c6b52edb · 2024-03-31T20:38:47.000+02:00
Co-authored-by: 翠 / green &lt;green@sapphi.red&gt;
diff --git a/packages/vite/src/node/plugins/html.ts b/packages/vite/src/node/plugins/html.ts
@@ -1189,8 +1189,13 @@ export function injectNonceAttributeTagHook(
 parseRelAttr(attr.value).some((a) => processRelType.has(a)),
 ))
 ) {
+ // if the closing of the start tag includes a `/`, the offset should be 2 so the nonce
+ // is appended prior to the `/`
+ const appendOffset =
+ html[node.sourceCodeLocation!.startTag!.endOffset - 2] === '/' ? 2 : 1
+
 s.appendRight(
- node.sourceCodeLocation!.startTag!.endOffset - 1,
+ node.sourceCodeLocation!.startTag!.endOffset - appendOffset,
 ` nonce="${nonce}"`,
 )
 }

-Original file line number
+Diff line change
 parseRelAttr(attr.value).some((a)=>processRelType.has(a)),
 ))
 ){
 +// if the closing of the start tag includes a `/`, the offset should be 2 so the nonce
 +// is appended prior to the `/`
 +constappendOffset=
 +html[node.sourceCodeLocation!.startTag!.endOffset-2]==='/' ? 2 : 1
++
 s.appendRight(
 -node.sourceCodeLocation!.startTag!.endOffset-1,
 +node.sourceCodeLocation!.startTag!.endOffset-appendOffset,
 ` nonce="${nonce}"`,
+)
+}