fix(storefront): Add missing nonces to all script tags

CHANGELOG.md

@@ -5,6 +5,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## Draft
+- Add nonce to all script tags [#2539](https://github.com/bigcommerce/cornerstone/pull/2539)
 
 ## 6.16.1 (02-14-2025)
 - Refactor cart, payment account page inline event handlers to event listeners [#2536](https://github.com/bigcommerce/cornerstone/pull/2536)

templates/components/products/schema.html

@@ -1,4 +1,4 @@
-<script type="application/ld+json">
+<script type="application/ld+json" nonce="{{nonce}}">
     {
         "@context": "https://schema.org/",
         "@type": "Product",

templates/pages/account/orders/invoice.html

@@ -203,7 +203,7 @@ <h2 class="InvoiceHeading">{{lang 'invoice.order_items'}}</h2>
             </div>
         </div>
     </div>
-    <script>
+    <script nonce="{{nonce}}">
         window.print();
     </script>
 {{/partial}}

templates/pages/order-confirmation.html

@@ -3,7 +3,7 @@
 {{{ stylesheet '/assets/css/optimized-checkout.css' }}}
 {{ getFontsCollection }}
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="{{nonce}}">
     window.language = {{{langJson 'optimized_checkout'}}};
 </script>
 

templates/pages/subscribed.html

@@ -19,7 +19,7 @@ <h1 class="page-heading" tabindex="0" role="status" aria-live="assertive">
     </div>
 </section>
 
-<script>
+<script nonce="{{nonce}}">
     const subscriptionStatusElement = document.querySelector('.page-content > .page-heading');
     if (subscriptionStatusElement) subscriptionStatusElement.focus();
 </script>