When Csp::ff1313937() is checking if it needs to modify the policy, it checks for the string hash and not the proper hash algorithm prefixes.
$hasBugSource = array_reduce(
$directives['default-src'],
function ($return, $value) {
return $return || (
$value == Csp::POLICY_STRICT_DYNAMIC
||
preg_match("<^'(hash|nonce)->", $value)
);
},
FALSE
);
Change the regular expression to get the valid hash algorithms from Csp::HASH_ALGORITHMS
Fixed
1.0
Code