CSP: Provide a way to pass nonce to $.globalEval #4278
Description
In #3541 CSP support was introduced to not loose the nonce attribute of script tags when repacing/inserting DOM nodes.
Therefore DOMEval already has support for nonce.
As $.globalEval already uses DOMEval under the hood, it should be quite to allow to pass the nonce.
current scipt:
// Evaluates a script in a global context
globalEval: function( code ) {
DOMEval( code );
}
something like this should work:
// Evaluates a script in a global context
globalEval: function( code, nonce ) {
DOMEval( code, null, { nonce: nonce });
}
Workaround:
var script = document.createElement('script');
script.setAttribute('nonce', 'myNonce');
script.innerHTML = 'console.log("test")';
document.head.appendChild(script);