Use Content-Security-Policy: script nonce (#37232)

Fix #305
2026-04-16 04:07:57 +08:00
parent 2644bb8490
commit 82bfde2a37
18 changed files with 134 additions and 52 deletions
@@ -72,7 +72,7 @@ func (p *openAPIRenderer) Render(ctx *markup.RenderContext, input io.Reader, out
 </head>
 <body>
 	<div id="swagger-ui"><textarea class="swagger-spec-content" data-spec-filename="%s">%s</textarea></div>
-	<script type="module" src="%s"></script>
+	<script nonce type="module" src="%s"></script>
 </body>
 </html>`,
 		public.AssetURI("css/swagger.css"),