Merge pull request #673 from Baroshem/chore/2.5.1

Chore/2.5.1

Author: Baroshem

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "license": "MIT",
   "type": "module",
   "engines": {

src/module.ts

@@ -1,4 +1,4 @@
-import { defineNuxtModule, addServerHandler, installModule, addVitePlugin, addServerPlugin, createResolver, addImportsDir, useNitro, addServerImports, addTypeTemplate } from '@nuxt/kit'
+import { defineNuxtModule, addServerHandler, installModule, addVitePlugin, addServerPlugin, createResolver, addImportsDir, useNitro, addServerImports, addTypeTemplate, hasNuxtModule } from '@nuxt/kit'
 import { existsSync } from 'node:fs'
 import { readFile, readdir } from 'node:fs/promises'
 import { join, isAbsolute } from 'pathe'
@@ -313,6 +313,13 @@ export {}
         nuxt.hooks.callHook('nuxt-security:prerenderedHeaders', prerenderedHeaders)
       })
     })
+
+    // Adjust route rules for Nuxt Hints compatibility
+    if (hasNuxtModule('@nuxt/hints') && nuxt.options.dev) {
+      nuxt.options.routeRules = defu(nuxt.options.routeRules, {
+        '/__nuxt_hydration': { xssValidator: false }
+      })
+    }
   }
 })
 

src/runtime/nitro/plugins/40-cspSsrNonce.ts

@@ -6,7 +6,7 @@ const LINK_RE = /<link\b([^>]*?>)/gi
 const NONCE_RE = /nonce="[^"]+"/i
 const SCRIPT_RE = /<script\b([^>]*?>)/gi
 const STYLE_RE = /<style\b([^>]*?>)/gi
-const QUOTE_MASK_RE = /"([^"]*)"/g
+const QUOTE_MASK_RE = /"((?:[^"\\]|\\.)*)"/g
 const QUOTE_RESTORE_RE = /__QUOTE_PLACEHOLDER_(\d+)__/g
 
 function injectNonceToTags(element: string, nonce: string) {