From c4de024c89054150b9dde0553e8291042806b4fb Mon Sep 17 00:00:00 2001
From: Peter Valadez <valadezpm@gmail.com>
Date: Thu, 10 Apr 2025 18:33:54 -0400
Subject: [PATCH 1/2] Add missing handlebars nonces to all script tags

---
 templates/components/products/schema.html   | 2 +-
 templates/pages/account/orders/invoice.html | 2 +-
 templates/pages/order-confirmation.html     | 2 +-
 templates/pages/subscribed.html             | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/templates/components/products/schema.html b/templates/components/products/schema.html
index e636f0a75c..4244349da4 100644
--- a/templates/components/products/schema.html
+++ b/templates/components/products/schema.html
@@ -1,4 +1,4 @@
-<script type="application/ld+json">
+<script type="application/ld+json" nonce="{{nonce}}">
     {
         "@context": "https://schema.org/",
         "@type": "Product",
diff --git a/templates/pages/account/orders/invoice.html b/templates/pages/account/orders/invoice.html
index 244c1c291d..3b4e49657e 100644
--- a/templates/pages/account/orders/invoice.html
+++ b/templates/pages/account/orders/invoice.html
@@ -203,7 +203,7 @@ <h2 class="InvoiceHeading">{{lang 'invoice.order_items'}}</h2>
             </div>
         </div>
     </div>
-    <script>
+    <script nonce="{{nonce}}">
         window.print();
     </script>
 {{/partial}}
diff --git a/templates/pages/order-confirmation.html b/templates/pages/order-confirmation.html
index c11a95cdbf..66b8fc0c49 100644
--- a/templates/pages/order-confirmation.html
+++ b/templates/pages/order-confirmation.html
@@ -3,7 +3,7 @@
 {{{ stylesheet '/assets/css/optimized-checkout.css' }}}
 {{ getFontsCollection }}
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="{{nonce}}">
     window.language = {{{langJson 'optimized_checkout'}}};
 </script>
 
diff --git a/templates/pages/subscribed.html b/templates/pages/subscribed.html
index 623ec7f606..8e12505ec8 100644
--- a/templates/pages/subscribed.html
+++ b/templates/pages/subscribed.html
@@ -19,7 +19,7 @@ <h1 class="page-heading" tabindex="0" role="status" aria-live="assertive">
     </div>
 </section>
 
-<script>
+<script nonce="{{nonce}}">
     const subscriptionStatusElement = document.querySelector('.page-content > .page-heading');
     if (subscriptionStatusElement) subscriptionStatusElement.focus();
 </script>

From 2e81e33d40cc2fb23338ca909399502ae0a9789d Mon Sep 17 00:00:00 2001
From: Peter Valadez <valadezpm@gmail.com>
Date: Thu, 10 Apr 2025 18:48:33 -0400
Subject: [PATCH 2/2] Update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dcacbd3368..9fa310c5c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## Draft
+- Add nonce to all script tags [#2539](https://github.com/bigcommerce/cornerstone/pull/2539)
 
 ## 6.16.1 (02-14-2025)
 - Refactor cart, payment account page inline event handlers to event listeners [#2536](https://github.com/bigcommerce/cornerstone/pull/2536)