From dc5464a8fb72ad734eea42227e0ea46c58164437 Mon Sep 17 00:00:00 2001 From: Maiz Date: Thu, 17 Jan 2019 20:35:25 +0800 Subject: [PATCH] Fix csp nonce by removing getAttribute. (by PR #185 ) --- src/lib/mito.js | 2 +- src/log/default.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/lib/mito.js b/src/lib/mito.js index 35fc6921..a0d150ce 100644 --- a/src/lib/mito.js +++ b/src/lib/mito.js @@ -65,7 +65,7 @@ export default function render(tpl, data, toString) { let scriptList = document.getElementsByTagName('script'); let nonce = ''; if (scriptList.length > 0) { - nonce = scriptList[0].getAttribute('nonce') || ''; // get nonce to avoid `unsafe-inline` + nonce = scriptList[0].nonce || ''; // get nonce to avoid `unsafe-inline` } let script = document.createElement('SCRIPT'); script.innerHTML = codeWrap; diff --git a/src/log/default.js b/src/log/default.js index d3de8003..86f6f7f9 100644 --- a/src/log/default.js +++ b/src/log/default.js @@ -178,7 +178,7 @@ class VConsoleDefaultTab extends VConsoleLogTab { let scriptList = document.getElementsByTagName('script'); let nonce = ''; if (scriptList.length > 0) { - nonce = scriptList[0].getAttribute('nonce') || ''; // get nonce to avoid `unsafe-inline` + nonce = scriptList[0].nonce || ''; // get nonce to avoid `unsafe-inline` } let script = document.createElement('SCRIPT'); script.innerHTML = code;