From 3e4ebe579ed369e93816449bc95aa0786aee2943 Mon Sep 17 00:00:00 2001 From: Daniel Onyejesi Date: Sat, 21 Mar 2026 22:12:17 -0400 Subject: [PATCH] Fix: add scriptSrcAttr unsafe-inline to allow onclick handlers Helmet 8 adds script-src-attr: 'none' by default which blocks ALL inline event attribute handlers (onclick, onchange, etc.) regardless of script-src unsafe-inline. This silently broke every onclick button: copy, read aloud, nextcloud upload, generate, record, etc. --- server.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server.js b/server.js index 9d860ad..86a78ec 100644 --- a/server.js +++ b/server.js @@ -19,7 +19,8 @@ app.use(helmet({ contentSecurityPolicy: { directives: { defaultSrc: ["'self'"], - scriptSrc: ["'self'", "'unsafe-inline'"], // unsafe-inline needed for onclick handlers in HTML + scriptSrc: ["'self'", "'unsafe-inline'"], + scriptSrcAttr: ["'unsafe-inline'"], // allow onclick/onchange attribute handlers styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'], fontSrc: ["'self'", 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'], imgSrc: ["'self'", 'data:', 'blob:'],