Unnecessary data script execution requires unsafe CSP

[erquhart]

What version of astro are you using?

1.2.1

Are you using an SSR adapter? If so, which one?

None

What package manager are you using?

npm

What operating system are you using?

Mac

Describe the Bug

For discoverability/searchability, this issue is about errors due to data:text/javascript;charset=utf-8,//[no before-hydration script].

Astro outputs a noop script using data protocol for components with client directives (I've only tried React specifically). I don't know why its necessary, but the code comments indicate an assumption that browsers will just ignore it - this isn't the case if you have a CSP that doesn't allow script execution via the data protocol.

This results in some of our scripts not loading in production. I haven't found a clear workaround - I've even tried stripping the offending output post build, but that leaves a null value that results in an error.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-744pb4

In the reproduction, I've done the following

• Started with the basic Astro template via astro.new
• Converted the Card component to jsx (stripped out styles for simplicity)
• Added the react integration
• Added a minimal CSP via meta tag (script-src * 'unsafe-inline' 'unsafe-eval')

To reproduce:

1. Run npm start to run the dev server - you'll see "It's working!" printed in the console on each render.
2. Run npm run build && npm run preview to run the preview server and load the page in a separate window.
3. You'll see no "It's working!" log printed, and a CSP error that points to the data: script mentioned above.

Participation

• I am willing to submit a pull request for this issue.

I don't know enough about this issue to work on a pull request, but hopefully the repro is at least helpful if others run into this and want to better understand it.

[matthewp]

Thanks, we can probably just avoid adding this when it's not used

[matthewp]

PR to remove this when not used: #4768

[peterpeterparker]

I am migrating to Astro since a couple of days and was literally debugging this final issue today when I landed on this recent PR. Upgraded to last version and problem solved. You are the MVPs, thanks a lot!