fix: csp nonce injection when no closing tag (#16281) (#16282)

Co-authored-by: 翠 / green <[email protected]>
vitejs · Mar 31, 2024 · 3c85c6b · 3c85c6b
1 parent f1e67b6
commit 3c85c6b
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/packages/vite/src/node/plugins/html.ts b/packages/vite/src/node/plugins/html.ts
@@ -1189,8 +1189,13 @@ export function injectNonceAttributeTagHook(
               parseRelAttr(attr.value).some((a) => processRelType.has(a)),
           ))
       ) {
+        // if the closing of the start tag includes a `/`, the offset should be 2 so the nonce
+        // is appended prior to the `/`
+        const appendOffset =
+          html[node.sourceCodeLocation!.startTag!.endOffset - 2] === '/' ? 2 : 1
+
         s.appendRight(
-          node.sourceCodeLocation!.startTag!.endOffset - 1,
+          node.sourceCodeLocation!.startTag!.endOffset - appendOffset,
           ` nonce="${nonce}"`,
         )
       }