Core: Preserve CSP nonce on scripts in DOM manipulation

Fixes gh-3541
Closes gh-4269

1 files changed, 10 insertions, 0 deletions

diff --git a/src/core/DOMEval.js b/src/core/DOMEval.js
index 199ec9518..8d2d0023b 100644
--- a/src/core/DOMEval.js
+++ b/src/core/DOMEval.js
@@ -6,6 +6,7 @@ define( [
 	var preservedScriptAttributes = {
 		type: true,
 		src: true,
+		nonce: true,
 		noModule: true
 	};
 
@@ -20,6 +21,15 @@ define( [
 			for ( i in preservedScriptAttributes ) {
 				if ( node[ i ] ) {
 					script[ i ] = node[ i ];
+				} else if ( node.getAttribute( i ) ) {
+
+					// Support: Firefox 64+, Edge 18+
+					// Some browsers don't support the "nonce" property on scripts.
+					// On the other hand, just using `setAttribute` & `getAttribute`
+					// is not enough as `nonce` is no longer exposed as an attribute
+					// in the latest standard.
+					// See https://github.com/whatwg/html/issues/2369
+					script.setAttribute( i, node.getAttribute( i ) );
 				}
 			}
 		}