fix: add nonce in stream data part

Author: 0x221A

packages/kit/src/runtime/server/page/render.js

@@ -265,6 +265,7 @@ export async function render_response({
 		event,
 		options,
 		branch.map((b) => b.server_data),
+		csp,
 		global
 	);
 
@@ -522,10 +523,11 @@ export async function render_response({
  * @param {import('@sveltejs/kit').RequestEvent} event
  * @param {import('types').SSROptions} options
  * @param {Array<import('types').ServerDataNode | null>} nodes
+ * @param {import('./csp.js').Csp} csp
  * @param {string} global
  * @returns {{ data: string, chunks: AsyncIterable<string> | null }}
  */
-function get_data(event, options, nodes, global) {
+function get_data(event, options, nodes, csp, global) {
 	let promise_id = 1;
 	let count = 0;
 
@@ -564,7 +566,9 @@ function get_data(event, options, nodes, global) {
 							str = devalue.uneval({ id, data, error }, replacer);
 						}
 
-						push(`<script>${global}.resolve(${str})</script>\n`);
+						push(
+							`<script${csp.script_needs_nonce ? ` nonce="${csp.nonce}"` : ''}>${global}.resolve(${str})</script>\n`
+						);
 						if (count === 0) done();
 					}
 				);