From 1aaf4d6c9f682098e191e53e28cfa5a4b163f7d7 Mon Sep 17 00:00:00 2001
From: thebanjomatic <ahines57@gmail.com>
Date: Sat, 13 Apr 2024 08:26:27 -0600
Subject: [PATCH 1/2] feat: write cspNonce to style tags

---
 packages/vite/src/node/plugins/html.ts | 1 +
 playground/csp/index.html              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/vite/src/node/plugins/html.ts b/packages/vite/src/node/plugins/html.ts
index f5acc47a39d8ab..7d971375040b5c 100644
--- a/packages/vite/src/node/plugins/html.ts
+++ b/packages/vite/src/node/plugins/html.ts
@@ -1184,6 +1184,7 @@ export function injectNonceAttributeTagHook(
 
       if (
         nodeName === 'script' ||
+        nodeName === 'style' ||
         (nodeName === 'link' &&
           attrs.some(
             (attr) =>
diff --git a/playground/csp/index.html b/playground/csp/index.html
index c29d55054921d6..45a508e76a2cd3 100644
--- a/playground/csp/index.html
+++ b/playground/csp/index.html
@@ -1,5 +1,5 @@
 <link rel="stylesheet" href="./linked.css" />
-<style nonce="#$NONCE$#">
+<style>
   .inline {
     color: green;
   }

From 16b9a8cbe6cd24b65579cb3cc32159545c7915ac Mon Sep 17 00:00:00 2001
From: thebanjomatic <ahines57@gmail.com>
Date: Sat, 13 Apr 2024 09:31:20 -0600
Subject: [PATCH 2/2] docs(cspNonce): update to include <style>

---
 docs/guide/features.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/guide/features.md b/docs/guide/features.md
index 4d7d674f413743..75940b8d17310c 100644
--- a/docs/guide/features.md
+++ b/docs/guide/features.md
@@ -699,7 +699,7 @@ To deploy CSP, certain directives or configs must be set due to Vite's internals
 
 ### [`'nonce-{RANDOM}'`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#nonce-base64-value)
 
-When [`html.cspNonce`](/config/shared-options#html-cspnonce) is set, Vite adds a nonce attribute with the specified value to the output script tag and link tag for stylesheets. Note that Vite will not add a nonce attribute to other tags, such as `<style>`. Additionally, when this option is set, Vite will inject a meta tag (`<meta property="csp-nonce" nonce="PLACEHOLDER" />`).
+When [`html.cspNonce`](/config/shared-options#html-cspnonce) is set, Vite adds a nonce attribute with the specified value to any `<script>` and `<style>` tags, as well as `<link>` tags for stylesheets and module preloading. Additionally, when this option is set, Vite will inject a meta tag (`<meta property="csp-nonce" nonce="PLACEHOLDER" />`).
 
 The nonce value of a meta tag with `property="csp-nonce"` will be used by Vite whenever necessary during both dev and after build.