Follow-up from #275.
Problem
getLoadingHtml used to return a constant string. Since #275 it embeds a fresh nonce on every call (src/providers/componentBrowserProvider.ts:609), so two assignments that look identical now produce different HTML.
The cache-reset path does exactly that, back to back:
componentBrowserProvider.ts:2511 assigns the loading document- it then calls
loadComponents(true), which assigns it again at componentBrowserProvider.ts:156
Assigning webview.html a different string tears the document down and rebuilds it, so the spinner visibly restarts partway through a cache reset. While the string was constant, the second assignment was a no-op and nothing was visible.
Suggested fix
This document has no <script>, so it does not need a per-render nonce at all. Dropping script-src from its CSP leaves default-src 'none' to block scripts — stricter than a nonce, and it makes the string constant again.
Hoisting a module-level nonce would also work, but it would keep a nonce around for a document that has nothing to grant it to, which is the invariant worth preserving: a nonce exists because a script exists.
Follow-up from #275.
Problem
getLoadingHtmlused to return a constant string. Since #275 it embeds a fresh nonce on every call (src/providers/componentBrowserProvider.ts:609), so two assignments that look identical now produce different HTML.The cache-reset path does exactly that, back to back:
componentBrowserProvider.ts:2511assigns the loading documentloadComponents(true), which assigns it again atcomponentBrowserProvider.ts:156Assigning
webview.htmla different string tears the document down and rebuilds it, so the spinner visibly restarts partway through a cache reset. While the string was constant, the second assignment was a no-op and nothing was visible.Suggested fix
This document has no
<script>, so it does not need a per-render nonce at all. Droppingscript-srcfrom its CSP leavesdefault-src 'none'to block scripts — stricter than a nonce, and it makes the string constant again.Hoisting a module-level nonce would also work, but it would keep a nonce around for a document that has nothing to grant it to, which is the invariant worth preserving: a nonce exists because a script exists.