From f1f83507dbf655ceb67a07b41a2765e00499add3 Mon Sep 17 00:00:00 2001
From: Dylan Staley <staleydyla.n@gmail.com>
Date: Thu, 19 Oct 2017 12:30:34 -0700
Subject: [PATCH] Use nonce attribute for inline script if provided (#3129)

---
 server/document.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/document.js b/server/document.js
index a536f2d77e..c33ffc9bdf 100644
--- a/server/document.js
+++ b/server/document.js
@@ -117,6 +117,10 @@ export class Main extends Component {
 }
 
 export class NextScript extends Component {
+  static propTypes = {
+    nonce: PropTypes.string
+  }
+
   static contextTypes = {
     _documentProps: PropTypes.any
   }
@@ -176,7 +180,7 @@ export class NextScript extends Component {
     __NEXT_DATA__.chunks = chunks
 
     return <div>
-      {staticMarkup ? null : <script dangerouslySetInnerHTML={{
+      {staticMarkup ? null : <script nonce={this.props.nonce} dangerouslySetInnerHTML={{
         __html: `
           __NEXT_DATA__ = ${htmlescape(__NEXT_DATA__)}
           module={}
-- 
GitLab