Incorrect hashes generated causing CSP violations when styles and javascripts are inlined

[warnyul]

Description

The @melloware/csp-webpack-plugin generates incorrect hashes, resulting in CSP violations when using the generated index.html file.

This issue mirrors the problem described in the original issue raised for slackhq/csp-html-webpack-plugin:

• Original Issue: #126 on slackhq/csp-html-webpack-plugin

To help reproduce and diagnose the problem, I have created a GitHub repository and deployed the site for reference:

• Reproduction repository: github.com/warnyul csp-2 branch
• Deployed site: https://bvarga-fe600--pr84-csp-2-0qs98x2e.web.app/

Observations

I think I’ve identified the root cause of the CSP violations. It’s related to cheerio when _useHtmlParser2 is set to true. In this mode, cheerio modifies the content of <style> and <script> tags by replacing special characters like <, >, and & with their HTML entities (<, >, &).

This transformation causes a mismatch between the original tag content (used to generate the CSP hash) and the altered content in the output, resulting in CSP violations.

What type of issue is this? (place an x in one of the [ ])

• bug
• enhancement (feature request)
• question
• documentation related
• testing related
• discussion

Bug Report

Reproducible in:

@melloware/csp-webpack-plugin version: 6.0.4

node version: 22.10.0

OS version(s): macOS Sequoia 15.01, Ubuntu 24.04

Steps to reproduce:

1. Clone the reproduction repository: git clone https://github.com/warnyul/bvarga.dev.git
2. Checkout csp-2 branch: git checkout csp-2
3. Install dependencies: npm install
4. Build the project: npm run build
5. Open index.html in dist folder using Safari or Google Chrome.

Expected result:

The hashes generated by the @melloware/csp-webpack-plugin should correctly match the content of the built files.

Actual result:

The hashes generated by the plugin do not match the content of the files, causing CSP violations in the browser when accessing the deployed site. Manually generated hashes work correctly when applied.

[melloware]

Feel free to submit a PR