Update csp.ts (#13953)

zaitovalisher · ematipico · web-flow · commit 448bddc49492 · 2025-06-16T12:44:28.000+01:00
Co-authored-by: Emanuele Stoppa &lt;my.burning@gmail.com&gt;
diff --git a/.changeset/seven-actors-change.md b/.changeset/seven-actors-change.md
@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes a bug where quotes were not added to the  'strict-dynamic' CSP directive
diff --git a/packages/astro/src/runtime/server/render/csp.ts b/packages/astro/src/runtime/server/render/csp.ts
@@ -35,7 +35,7 @@ export function renderCspContent(result: SSRResult): string {
 		styleResources = result.styleResources.map((r) => `${r}`).join(' ');
 	}
 
-	const strictDynamic = result.isStrictDynamic ? ` strict-dynamic` : '';
+	const strictDynamic = result.isStrictDynamic ? ` 'strict-dynamic'` : '';
 	const scriptSrc = `script-src ${scriptResources} ${Array.from(finalScriptHashes).join(' ')}${strictDynamic};`;
 	const styleSrc = `style-src ${styleResources} ${Array.from(finalStyleHashes).join(' ')};`;
 	return `${directives} ${scriptSrc} ${styleSrc}`;

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'astro': patch
 +---
++
 +Fixes a bug where quotes were not added to the  'strict-dynamic' CSP directive
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ export function renderCspContent(result: SSRResult): string {`
`35`	`35`	styleResources = result.styleResources.map((r) => `${r}`).join(' ');
`36`	`36`	`}`
`37`	`37`
`38`		- const strictDynamic = result.isStrictDynamic ? ` strict-dynamic` : '';
	`38`	+ const strictDynamic = result.isStrictDynamic ? ` 'strict-dynamic'` : '';
`39`	`39`	const scriptSrc = `script-src ${scriptResources} ${Array.from(finalScriptHashes).join(' ')}${strictDynamic};`;
`40`	`40`	const styleSrc = `style-src ${styleResources} ${Array.from(finalStyleHashes).join(' ')};`;
`41`	`41`	return `${directives} ${scriptSrc} ${styleSrc}`;