vike-react 0.6.16 → 0.6.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -18,6 +18,7 @@ function useConfig() {
18
18
  return (config) => setPageContextConfigViaHook(config, pageContext);
19
19
  // Component
20
20
  pageContext = usePageContext();
21
+ assert(!pageContext.isClientSide);
21
22
  const stream = useStreamOptional();
22
23
  return (config) => {
23
24
  if (!pageContext._headAlreadySet) {
@@ -26,7 +27,7 @@ function useConfig() {
26
27
  else {
27
28
  assert(stream);
28
29
  // <head> already sent to the browser => send DOM-manipulating scripts during HTML streaming
29
- apply(config, stream);
30
+ apply(config, stream, pageContext);
30
31
  }
31
32
  };
32
33
  }
@@ -55,10 +56,12 @@ function setPageContextConfigViaHook(config, pageContext) {
55
56
  }
56
57
  });
57
58
  }
58
- function apply(config, stream) {
59
+ function apply(config, stream, pageContext) {
59
60
  const { title } = config;
60
61
  if (title) {
61
- const htmlSnippet = `<script>document.title = ${JSON.stringify(title)}</script>`;
62
+ // No need to escape the injected HTML — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
63
+ const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : '';
64
+ const htmlSnippet = `<script${nonceAttr}>document.title = ${JSON.stringify(title)}</script>`;
62
65
  stream.injectToStream(htmlSnippet);
63
66
  }
64
67
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "vike-react",
3
- "version": "0.6.16",
3
+ "version": "0.6.17",
4
4
  "repository": "https://github.com/vikejs/vike-react",
5
5
  "type": "module",
6
6
  "exports": {