style-src

I think you should include the 2 domains in your script-src directive from the “base rules” tab and chose nonce for external sources in script-src (the option is in the settings tab)

I entered the domains and nonce was selected, but still not working. The domain is whitelisted as well. I changed to hash and then back to nonce, but still…

In your previous message you said that nonce was enabled for style-src and not for script-src. Can you double check it and post a screenshot of your settings?

More, can you post the relevant part of the html with the <script> tags that require those sources?

There could be a problem if those tags are added by another script that uses appendChild() or insertBefore() (I am working on this for next release) but it is impossible to guess it, if I cannot see the page.

Hopefully you can see those. Settings are both nonce…

that is not an external script, but an inline one.

Please, enable nonce for inline scripts too (it is another option called inline_scripts_mode ) and it is just beyond SRI options.

Do you know how it is added to the page? It is after the html closing tab, why?

inline scripts is set to nonce.

It is Query Monitor plugin that is putting it in there.

Thanks,

@fuzzy21 I’m working on this issue.

The problem is:
no-unsafe-inline (via its mu-plugin) adds a closure to the shutdown action hook with 0 priority (and this is needed to be sure that the closure is executed before wp runs ob_end_flush() on each open output buffer level);

query-monitor adds to the shutdown hook an action to dispatch its output with a priority of 9 https://github.com/johnbillion/query-monitor/blob/2b58634b37b8e7de52d8363c741053f42b7c8079/dispatchers/Html.php#L52

This causes that the action added by query monitor runs after that no-unsafe-inline performs its stuff, and this is why the query-monitor inline scripts are not captured (and cannot be whitelisted).

However, if I simply increase the priority of the no-unsafe-inline closure to something bigger than 9, it will run after that wp default action has run because the wp core adds this action with a priority of 1:

https://github.com/WordPress/wordpress-develop/blob/e3e7fdbf7c3fd9f04871118a16b98f1544e94984/src/wp-includes/default-filters.php#L413

Now I’m testing a solution that will early remove the default wp action when no-unsafe-inline is in place, and then, arise the no-unsafe-inline closure priority to be sure it runs after all others actions added to the shutdown hook.

Please, wait for next release, and thanks for reporting.

Great, thank you, looking forward to trying it.