Cyclomedia: add nonce to iframe document script elements

manisandro · manisandro · commit ebec10f6dd36 · 2025-12-15T11:19:56.000+01:00
diff --git a/plugins/Cyclomedia.jsx b/plugins/Cyclomedia.jsx
@@ -337,10 +337,10 @@ class Cyclomedia extends React.Component {
             <!DOCTYPE html>
             <html>
             <head>
-            <script type="text/javascript" src="https://unpkg.com/react@18.3.1/umd/react.production.min.js"></script>
-            <script type="text/javascript" src="https://unpkg.com/react-dom@18.3.1/umd/react-dom.production.min.js"></script>
-            <script type="text/javascript" src="https://streetsmart.cyclomedia.com/api/v${this.props.cyclomediaVersion}/StreetSmartApi.js"></script>
-            <script type="text/javascript">
+            <script nonce="${window.__CSP_NONCE__ ?? ''}" type="text/javascript" src="https://unpkg.com/react@18.3.1/umd/react.production.min.js"></script>
+            <script nonce="${window.__CSP_NONCE__ ?? ''}" type="text/javascript" src="https://unpkg.com/react-dom@18.3.1/umd/react-dom.production.min.js"></script>
+            <script nonce="${window.__CSP_NONCE__ ?? ''}" type="text/javascript" src="https://streetsmart.cyclomedia.com/api/v${this.props.cyclomediaVersion}/StreetSmartApi.js"></script>
+            <script nonce="${window.__CSP_NONCE__ ?? ''}" type="text/javascript">
             let apiInitialized = false;
             let initCallback = null;
             let posCallback = null;
