Hashes shouldn't be added to CSP if unsafe-inline is present #17663

Astro Info

Astro                    v7.1.3
Node                     v24.18.0
System                   macOS (arm64)
Package Manager          pnpm
Output                   static
Adapter                  @astrojs/node
Integrations             @astrojs/react
                         @astroscope/boot (v0.6.10)
                         astro-iconset (v0.0.6)
                         @astrojs/sitemap
                         @astrojs/markdoc (v2.0.4)
                         playground
                         @astrojs/svelte (v9.0.1)
                         pagefind
                         static-security-headers
                         enforce-public-allowlist

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

Basically I still have this issue #14798 because in our site some tracking script injects a style element with contents that are dynamic on every load (session-random class names), so I can't even compute the hashes beforehand, I need to use unsafe-inline for style-src (or style-src-elem)

the fix only allows

style-src-attr 'unsafe-inline'

if you try to add the same to style-src or to style-src-elem the hashes will be injected and unsafe-inline will be disabled, effectively leaving me with no solution for the moment if I want to use security.csp in the astro config.

Note: the repro emulates the tracking script, if I had control over it's logic I obviously wouldn't use it that way.

What's the expected result?

Support unsafe-inline fully even if it's not good practice to use them, because anyone forced to use unsafe-inline is locked out of the Astro-supported CSP configuration.

Link to Minimal Reproducible Example

https://github.com/Gr3q/astro-scp-elem-repro

Participation

• I am willing to submit a pull request for this issue.