{"record":{"id":"e31752ff9cc1aad1","repo":"docmirror/dev-sidecar","slug":"getnonce-csp-nonce-csp","errorCode":null,"errorMessage":"getNonce: CSP 存在但未匹配到 nonce, CSP:","messagePattern":"getNonce: CSP 存在但未匹配到 nonce, CSP:","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/mitmproxy/src/lib/interceptor/impl/res/script.js","lineNumber":27,"sourceCode":"\nfunction getScript (key, script, nonce) {\n  const scriptUrl = SCRIPT_URL_PRE + key\n  return `<script crossorigin=\"anonymous\" defer=\"defer\" type=\"application/javascript\" src=\"${scriptUrl}\"${nonce}></script>`\n}\nfunction getScriptByUrlOrPath (scriptUrlOrPath, nonce) {\n  return `<script crossorigin=\"anonymous\" defer=\"defer\" type=\"application/javascript\" src=\"${scriptUrlOrPath}\"${nonce}></script>`\n}\n\n// 从 CSP 头中提取 nonce 值，用于注入脚本以通过 'strict-dynamic' 检查\nfunction getNonceAttr (proxyRes) {\n  // CSP 可能在 content-security-policy 或 content-security-policy-report-only 中\n  const csp = proxyRes.headers['content-security-policy']\n    || proxyRes.headers['content-security-policy-report-only']\n  if (!csp) return ''\n  // 支持单引号和双引号包裹的 nonce 值\n  const match = csp.match(/['\"]nonce-([^'\"]+)['\"]/)\n  if (!match) {\n    log.warn('getNonce: CSP 存在但未匹配到 nonce, CSP:', csp.substring(0, 500))\n    return ''\n  }\n  return ` nonce=\"${match[1]}\"`\n}\n\nmodule.exports = {\n  name: 'script',\n  priority: 211,\n  responseIntercept (context, interceptOpt, req, res, proxyReq, proxyRes, ssl, next) {\n    const { rOptions, log, setting } = context\n\n    // github特殊处理\n    if (rOptions.hostname === 'github.com' && rOptions.headers['turbo-frame'] === 'repo-content-turbo-frame') {\n      return\n    }\n\n    // 如果没有响应头 'content-type'，或其值不是 'text/html'，则不处理\n    if (!proxyRes.headers['content-type'] || !proxyRes.headers['content-type'].includes('text/html')) {","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/docmirror/dev-sidecar/blob/7710cd56cce760c708f30b01d2d4056eb8c402d5/packages/mitmproxy/src/lib/interceptor/impl/res/script.js#L9-L45","documentation":"When injecting scripts into an HTML response, the library extracts the CSP nonce from the response's `content-security-policy` (or report-only) header so injected <script> tags are allowed. If a CSP header exists but its text contains no `nonce-xxx` token matching the regex, it logs this warning (truncated to 500 chars) and returns an empty string — the injected script then has no nonce attribute.","triggerScenarios":"A proxied site sends a CSP header without any script-src nonce directive (e.g. only 'unsafe-inline', hashes, or strict-dynamic without nonce), while script injection is enabled for that domain.","commonSituations":"Sites using CSP hash-based policies; report-only CSPs without nonces; CDNs or servers stripping nonces; dynamically generated CSPs with unusual quoting.","solutions":["Disable script injection for that domain in the interceptor config if nonce injection cannot succeed.","Verify the CSP actually contains a script-src nonce (check response headers in DevTools); if only hashes are used, nonces cannot be extracted by design.","Configure the site/server to include 'nonce-<value>' in its script-src so the regex matches.","Ignore the warning for report-only CSPs — they enforce nothing, but injection may still be blocked elsewhere; check console for CSP violations."],"exampleFix":"// server before\nContent-Security-Policy: script-src 'self' 'unsafe-inline'\n// after\nContent-Security-Policy: script-src 'self' 'nonce-r4nd0mValue'","handlingStrategy":"fallback","validationCode":"const csp = res.headers['content-security-policy'] || ''\nconst hasNonce = /['\"]nonce-[^'\"]+['\"]/.test(csp)\nif (csp && !hasNonce) disableScriptInjectionForThisDomain()","typeGuard":"const cspHasNonce = (csp) => typeof csp === 'string' && /['\"]nonce-([^'\"]+)['\"]/.test(csp)","tryCatchPattern":null,"preventionTips":["Check response CSP headers before enabling script injection per domain","Disable injection for hash-based or nonce-less CSP sites","Watch the browser console for CSP violations after injection"],"tags":["csp","nonce","script-injection","security"],"backgroundTag":"csp-nonce-missing","analyzedSha":"7710cd56cce760c708f30b01d2d4056eb8c402d5","analyzedAt":"2026-08-31T22:07:07.234Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}