Does "Is Element Nonceable" apply to non-inline scripts?

[evilpie]

I don't see any reason why 6.7.3.1. Is element nonceable? shouldn't apply to non-inline scripts/styles (i.e. <script src="foo.js" nonce="bar">). However the algorithm doesn't seem to be called from Script directives pre-request check, instead that algorithm directly uses § 6.7.2.3 Does nonce match source list?. It is explicitly used from § 6.7.3.3 Does element match source list for type and source?, called by the various inline checks.

nonce-enforce-blocked.html seems to expect the check to apply to non-inline scripts.

[evilpie]

Post-post-clarity strikes again: I guess for non-inline scripts, we are operating on requests, so the "Is element nonceable?" check needs to happen before the request is created. Probably somewhere in HTML's prepare the script element, which currently sets the cryptographic nonce. So this is maybe just missing?