mirror of
https://github.com/angular/angular-cli.git
synced 2025-05-22 06:41:45 +08:00
955b493b13
Based on https://github.com/angular/angular-cli/pull/24880#pullrequestreview-1347993316. Critters can generate `link` tags with inline `onload` handlers which breaks CSP. These changes update the style nonce processor to remove the `onload` handlers and replicate the behavior with an inline `script` tag that gets the proper nonce. Note that earlier we talked about doing this through Critters which while possible, would still require a custom HTML processor, because we need to both add and remove attributes from an element.