Also find nonce in script-src-elem

[adrianbj]

If you have onclick or other inline event handlers, you might put your nonce in script-src-elem rather than script-src. This will find either way.

• bug fix / new feature? new feature I suppose.
• BC break? no

[dg]

This directive only specifies valid sources for inline script event handlers like onclick. It does not apply to other JavaScript sources that can trigger script execution, such as URLs loaded directly into <script>

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src-attr

[adrianbj]

Hi @dg - yes, I understand that. Sorry, my bad - my note might have confused you - it should say script-src-elem like the title of the PR does, rather than script-src-attr