From dd9e88eddb24412cfaa82a22c92a9050d44773d0 Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Thu, 15 Aug 2019 14:10:24 +0800
Subject: [PATCH] Add nonce to eval in shortcuts.js

Prevents the eval script being blocked when
we have CSP rules to disable inline scripts
---
 app/assets/javascripts/behaviors/shortcuts/shortcuts.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/behaviors/shortcuts/shortcuts.js b/app/assets/javascripts/behaviors/shortcuts/shortcuts.js
index eade1283513..7e3515b1f4b 100644
--- a/app/assets/javascripts/behaviors/shortcuts/shortcuts.js
+++ b/app/assets/javascripts/behaviors/shortcuts/shortcuts.js
@@ -4,7 +4,7 @@ import Mousetrap from 'mousetrap';
 import axios from '../../lib/utils/axios_utils';
 import { refreshCurrentPage, visitUrl } from '../../lib/utils/url_utility';
 import findAndFollowLink from '../../lib/utils/navigation_utility';
-import { parseBoolean } from '~/lib/utils/common_utils';
+import { parseBoolean, getCspNonceValue } from '~/lib/utils/common_utils';
 
 const defaultStopCallback = Mousetrap.stopCallback;
 Mousetrap.stopCallback = (e, element, combo) => {
@@ -94,7 +94,7 @@ export default class Shortcuts {
         responseType: 'text',
       })
       .then(({ data }) => {
-        $.globalEval(data);
+        $.globalEval(data, { nonce: getCspNonceValue() });
 
         if (location && location.length > 0) {
           const results = [];