fix: missing leading space before user-supplied value

site/_headers

@@ -0,0 +1,2 @@
+/*
+  Content-Security-Policy: img-src 'self' blob: data:; script-src 'sha256-/Cb4VxgL2aVP0MVDvbP0DgEOUv+MeNQmZX4yXHkn/c0='

site/index.html

@@ -45,7 +45,17 @@ <h1>Using CSP Nonces on Script Tags</h1>
       );
     </script>
     <script>
-      var CHECKS_COUNT = 5;
+      // test for https://github.com/netlify/plugin-csp-nonce/issues/72 case
+      document.write(
+        "<scr" +
+          "ipt>" +
+          "document.write('<p>✅ User-defined script-src value is preserved!</p>');" +
+          "</scr" +
+          "ipt>",
+      );
+    </script>
+    <script>
+      var CHECKS_COUNT = 6;
       if (document.getElementsByTagName("p").length === CHECKS_COUNT) {
         document.write("<p>✅ Test suite has succeeded</p>");
       } else {

src/__csp-nonce.ts

@@ -92,7 +92,9 @@ const handler = async (request: Request, context: Context) => {
         const d = directive.trim();
         // intentionally add trailing space to avoid mangling `script-src-elem`
         if (d.startsWith("script-src ")) {
-          return d.replace("script-src ", scriptSrc);
+          // append with trailing space to include any user-supplied values
+          // https://github.com/netlify/plugin-csp-nonce/issues/72
+          return d.replace("script-src ", `${scriptSrc} `).trim();
         }
         // intentionally omit report-uri: theirs should take precedence
         return d;