Use Content-Security-Policy: script nonce (#37232)

Fix #305
2026-04-16 04:07:57 +08:00
parent 2644bb8490
commit 82bfde2a37
18 changed files with 134 additions and 52 deletions
@@ -75,7 +75,7 @@
 				{{if .DisableAutosize}}data-disable-autosize="{{.DisableAutosize}}"{{end}}
 			>{{.TextareaContent}}</textarea>
 		</text-expander>
-		<script>
+		<script nonce="{{ctx.CspScriptNonce}}">
 			if (window.localUserSettings.getBoolean('markdown-editor-monospace')) {
 				document.querySelector('.markdown-text-editor').classList.add('tw-font-mono');
 			}