style-src

I think you should include the 2 domains in your script-src directive from the “base rules” tab and chose nonce for external sources in script-src (the option is in the settings tab)

In your previous message you said that nonce was enabled for style-src and not for script-src. Can you double check it and post a screenshot of your settings?

More, can you post the relevant part of the html with the <script> tags that require those sources?

There could be a problem if those tags are added by another script that uses appendChild() or insertBefore() (I am working on this for next release) but it is impossible to guess it, if I cannot see the page.

that is not an external script, but an inline one.

Please, enable nonce for inline scripts too (it is another option called inline_scripts_mode ) and it is just beyond SRI options.

Do you know how it is added to the page? It is after the html closing tab, why?

@fuzzy21 I’m working on this issue.

The problem is:
no-unsafe-inline (via its mu-plugin) adds a closure to the shutdown action hook with 0 priority (and this is needed to be sure that the closure is executed before wp runs ob_end_flush() on each open output buffer level);

query-monitor adds to the shutdown hook an action to dispatch its output with a priority of 9 https://github.com/johnbillion/query-monitor/blob/2b58634b37b8e7de52d8363c741053f42b7c8079/dispatchers/Html.php#L52

This causes that the action added by query monitor runs after that no-unsafe-inline performs its stuff, and this is why the query-monitor inline scripts are not captured (and cannot be whitelisted).

However, if I simply increase the priority of the no-unsafe-inline closure to something bigger than 9, it will run after that wp default action has run because the wp core adds this action with a priority of 1:

https://github.com/WordPress/wordpress-develop/blob/e3e7fdbf7c3fd9f04871118a16b98f1544e94984/src/wp-includes/default-filters.php#L413

Now I’m testing a solution that will early remove the default wp action when no-unsafe-inline is in place, and then, arise the no-unsafe-inline closure priority to be sure it runs after all others actions added to the shutdown hook.

Please, wait for next release, and thanks for reporting.