fix: do not add content-security-policy meta element if content is em…

…pty (#10026)
sveltejs · May 26, 2023 · 1c0423b · 1c0423b
1 parent 86dd16c
commit 1c0423b
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/.changeset/heavy-eels-wash.md b/.changeset/heavy-eels-wash.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: do not add content-security-policy meta element if content is empty
diff --git a/packages/kit/src/runtime/server/page/csp.js b/packages/kit/src/runtime/server/page/csp.js
@@ -178,8 +178,13 @@ class BaseProvider {
 
 class CspProvider extends BaseProvider {
 	get_meta() {
-		const content = escape_html_attr(this.get_header(true));
-		return `<meta http-equiv="content-security-policy" content=${content}>`;
+		const content = this.get_header(true);
+
+		if (!content) {
+			return;
+		}
+
+		return `<meta http-equiv="content-security-policy" content=${escape_html_attr(content)}>`;
 	}
 }