From bd4b3a2ecc2415e457940cc394866cdcfa3e5490 Mon Sep 17 00:00:00 2001
From: Daniel Gray <the.daniel.gray@gmail.com>
Date: Thu, 26 Mar 2026 02:20:58 +0100
Subject: [PATCH 1/3] fix: scrollbar measurement missing CSP nonce when
 creating <style>

---
 src/getScrollBarSize.tsx | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/getScrollBarSize.tsx b/src/getScrollBarSize.tsx
index 35709437..ff2d7415 100644
--- a/src/getScrollBarSize.tsx
+++ b/src/getScrollBarSize.tsx
@@ -10,7 +10,7 @@ type ExtendCSSStyleDeclaration = CSSStyleDeclaration & {
 
 let cached: ScrollBarSize;
 
-function measureScrollbarSize(ele?: HTMLElement): ScrollBarSize {
+function measureScrollbarSize(ele?: HTMLElement, csp?: { nonce?: string }): ScrollBarSize {
   const randomId = `rc-scrollbar-measure-${Math.random()
     .toString(36)
     .substring(7)}`;
@@ -53,6 +53,7 @@ ${widthStyle}
 ${heightStyle}
 }`,
         randomId,
+        { csp },
       );
     } catch (e) {
       // Can't wrap, just log error
@@ -98,7 +99,7 @@ export default function getScrollBarSize(fresh?: boolean): number {
   return cached.width;
 }
 
-export function getTargetScrollBarSize(target: HTMLElement) {
+export function getTargetScrollBarSize(target: HTMLElement, csp?: { nonce?: string }) {
   if (
     typeof document === 'undefined' ||
     !target ||
@@ -107,5 +108,5 @@ export function getTargetScrollBarSize(target: HTMLElement) {
     return { width: 0, height: 0 };
   }
 
-  return measureScrollbarSize(target);
+  return measureScrollbarSize(target, csp);
 }

From aff757c26005f9be54b81d307408a36d9f01b0dc Mon Sep 17 00:00:00 2001
From: Daniel Gray <the.daniel.gray@gmail.com>
Date: Thu, 26 Mar 2026 04:00:30 +0100
Subject: [PATCH 2/3] chore: add test to validate the CSP nonce is used to
 render the style

---
 tests/getScrollBarSize.test.ts | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/getScrollBarSize.test.ts b/tests/getScrollBarSize.test.ts
index 9c03b945..3bfa9aee 100644
--- a/tests/getScrollBarSize.test.ts
+++ b/tests/getScrollBarSize.test.ts
@@ -47,5 +47,27 @@ describe('getScrollBarSize', () => {
         height: 0,
       });
     });
+
+    it('should pass csp nonce to updateCSS', () => {
+      const updateCSSSpy = jest.spyOn(
+        require('../src/Dom/dynamicCSS'),
+        'updateCSS',
+      );
+
+      const target = document.createElement('div');
+      document.body.appendChild(target);
+
+      const nonce = 'test-nonce-123';
+      getTargetScrollBarSize(target, { nonce });
+
+      expect(updateCSSSpy).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(String),
+        { csp: { nonce } },
+      );
+
+      updateCSSSpy.mockRestore();
+      document.body.removeChild(target);
+    });
   });
 });

From b3cf67b088f7c106591b20cb51a51d9dec5ded41 Mon Sep 17 00:00:00 2001
From: Daniel Gray <the.daniel.gray@gmail.com>
Date: Thu, 26 Mar 2026 04:38:46 +0100
Subject: [PATCH 3/3] fix: ensure that the test mocks don't leak on failures

---
 tests/getScrollBarSize.test.ts | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tests/getScrollBarSize.test.ts b/tests/getScrollBarSize.test.ts
index 3bfa9aee..083ebd94 100644
--- a/tests/getScrollBarSize.test.ts
+++ b/tests/getScrollBarSize.test.ts
@@ -57,17 +57,19 @@ describe('getScrollBarSize', () => {
       const target = document.createElement('div');
       document.body.appendChild(target);
 
-      const nonce = 'test-nonce-123';
-      getTargetScrollBarSize(target, { nonce });
+      try {
+        const nonce = 'test-nonce-123';
+        getTargetScrollBarSize(target, { nonce });
 
-      expect(updateCSSSpy).toHaveBeenCalledWith(
-        expect.any(String),
-        expect.any(String),
-        { csp: { nonce } },
-      );
-
-      updateCSSSpy.mockRestore();
-      document.body.removeChild(target);
+        expect(updateCSSSpy).toHaveBeenCalledWith(
+          expect.any(String),
+          expect.any(String),
+          { csp: { nonce } },
+        );
+      } finally {
+        updateCSSSpy.mockRestore();
+        document.body.removeChild(target);
+      }
     });
   });
 });