`csp_meta_tag` helper generates a meta tag w/o out making use of the nonce hiding which could lead to nonce value exfiltration of nonce data about rails HOT 2 OPEN

I think we should make this change, but I'm not sure what the impact is on existing JS libraries. We're going to have to coordinate fixing Rails along with the corresponding JS libraries. If someone wants to handle that work, I'd really appreciate it!

from rails.

On the rails side, I wonder if it would make sense to add a depreciation warning for csp_meta_tag and introduce a csp_nonce_meta_tag with the new behaviour. This would allow for a more graceful upgrade path.

I can take a shot at some PRs, I think the JS libraries can be made backwards compatible by looking for both nonce & content prior to the rails change.

Question: How are the JS files updated which are included in the Rails source? IE should I make PRs against both Trix & Rails for the change, or would just against the Trix repo be enough & the changes will be applied to the rails Trix asset at some point?

from rails.