From e56133a43e6c5b929ee2c60ddd26d7688b0a91d7 Mon Sep 17 00:00:00 2001
From: pupiltong <12288479+PupilTong@users.noreply.github.com>
Date: Tue, 9 Dec 2025 20:46:27 +0800
Subject: [PATCH] fix: support CSP for mts

---
 .changeset/full-wombats-relate.md                           | 5 +++++
 .../web-core/src/uiThread/createRenderAllOnUI.ts            | 6 ++++++
 2 files changed, 11 insertions(+)
 create mode 100644 .changeset/full-wombats-relate.md

diff --git a/.changeset/full-wombats-relate.md b/.changeset/full-wombats-relate.md
new file mode 100644
index 0000000000..56e4a3a57f
--- /dev/null
+++ b/.changeset/full-wombats-relate.md
@@ -0,0 +1,5 @@
+---
+"@lynx-js/web-core": patch
+---
+
+fix: support CSP for mts
diff --git a/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts b/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts
index 0a228c619b..7ca80147d7 100644
--- a/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts
+++ b/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts
@@ -22,6 +22,11 @@ import { dispatchLynxViewEvent } from '../utils/dispatchLynxViewEvent.js';
 import { createExposureMonitor } from './crossThreadHandlers/createExposureMonitor.js';
 import type { StartUIThreadCallbacks } from './startUIThread.js';
 
+const existingScript = document.querySelector('script[nonce]') as
+  | HTMLScriptElement
+  | null;
+const nonce = existingScript?.nonce || existingScript?.getAttribute('nonce');
+
 const {
   prepareMainThreadAPIs,
 } = await import(
@@ -63,6 +68,7 @@ async function createIFrameRealm(parent: Node): Promise<JSRealm> {
     script.fetchPriority = 'high';
     script.defer = true;
     script.async = false;
+    script.nonce = nonce || '';
     iframe.contentDocument!.head.appendChild(script);
     return new Promise(async (resolve, reject) => {
       script.onload = () => {