Merging existing script-src incorrectly, missing a space.

[rbliss]

Thanks for creating this plugin. We've been testing it out and ran into an issue. We have a CSP header set in our netlify.toml.

[[headers]]
  for = "/*"
  [headers.values]
     Content-Security-Policy = "img-src 'self' blob: data:; upgrade-insecure-requests; script-src  'sha256-test'"

When we include the plugin and deploy, the function appears to incorrectly merge the CSP header betweem the toml file and the rules generated by this plugin:

Content-Security-Policy: img-src 'self' blob: data:; upgrade-insecure-requests; script-src 'nonce-Z+TiRQyN2vWLRggZNdtCWfIc7NxH6PuW' 'strict-dynamic' 'unsafe-inline' 'self' https: http:'sha256-test'; report-uri /.netlify/functions/__csp-violations

It appears the merged content for script-src is missing a space between http and the original CSP string: http:'sha256-test' which causes the CSP to break for script src.

[jasonbarry]

Thanks for reporting @rbliss! Will investigate shortly

[rbliss]

Much appreciated @jasonbarry. Let me know if I can provide any further details to help.

[jasonbarry]

@rbliss we just released version 1.2.8 which should fix this problem -- can you upgrade and confirm if it fixes it for you? thanks!

[rbliss]

@jasonbarry confirmed fixed. Thanks for the quick turnaround.

[jasonbarry]

@rbliss Sure thing! Thanks for reporting. Going to close this out