Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (meta) {
const BODY_PREPEND =
meta.meta.text({ pbody: true }) +
meta.link.text({ pbody: true }) +
meta.style.text({ pbody: true }) +
meta.script.text({ pbody: true }) +
meta.noscript.text({ pbody: true })
if (BODY_PREPEND) {
APP = `${BODY_PREPEND}${APP}`
}
}
// Serialize state
const serializedSession = `window.${this.serverContext.globals.context}=${devalue(renderContext.nuxt)};`
if (shouldInjectScripts) {
APP += ``
}
// Calculate CSP hashes
const { csp } = this.options.render
const cspScriptSrcHashes = []
if (csp) {
// Only add the hash if 'unsafe-inline' rule isn't present to avoid conflicts (#5387)
const containsUnsafeInlineScriptSrc = csp.policies && csp.policies['script-src'] && csp.policies['script-src'].includes('\'unsafe-inline\'')
if (csp.unsafeInlineCompatibility || !containsUnsafeInlineScriptSrc) {
const hash = crypto.createHash(csp.hashAlgorithm)
hash.update(serializedSession)
cspScriptSrcHashes.push(`'${csp.hashAlgorithm}-${hash.digest('base64')}'`)
}