內容安全策略 (CSP) sha256 在 Chrome 74.x 中不匹配，但在 Chrome 75.x 中工作正常

Question

我試圖在我的網站上設定非常嚴格的內容安全策略（CSP），如下所示：

base-uri 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' 'report-sample' https: http: 'sha256-lfXlPY3+MCPOPb4mrw1Y961+745U3WlDQVcOXdchSQc=' 'sha256-rRMdkshZyJlCmDX27XnL7g3zXaxv7ei6Sg+yt4R3svU=' 'nonce-[CSP-NONCE]' 'Strict-Dynamic' 'unsafe-hashes';frame-src 'self';object-src 'none';report-uri /report-csp;

但我發現，在 Chrome/74.0.3729.169 中，與sha256-lfXlPY3+MCPOPb4mrw1Y961+745U3WlDQVcOXdchSQc=腳本「javascript:;」不符。

我知道它可以在 Chrome/75.x 中運行

來自 Chrome/74.0.3729.169 的報告如下：

{"csp-report":{"document-uri":"https://xxx.xxx.com/","referrer":"https://xxx.xxx.com/","violated-directive":"script-src-elem","effective-directive":"script-src-elem","original-policy":"base-uri 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' 'report-sample' https: http: 'sha256-lfXlPY3+MCPOPb4mrw1Y961+745U3WlDQVcOXdchSQc=' 'sha256-rRMdkshZyJlCmDX27XnL7g3zXaxv7ei6Sg+yt4R3svU=' 'nonce-ICXBmlKCIhrG35lflJLb' 'Strict-Dynamic' 'unsafe-hashes';frame-src 'self';object-src 'none';report-uri /report-csp;","disposition":"report","blocked-uri":"inline","line-number":1,"source-file":"https://xxx.xxx.com/","status-code":0,"script-sample":"javascript:;"}}

這是 Chrom 74.x 中的錯誤嗎？

FWIW，此策略中的另一個雜湊值在 Chrome 74.x 和 Chrome 75.x 中均有效。('sha256-rRMdkshZyJlCmDX27XnL7g3zXaxv7ei6Sg+yt4R3svU=' means 'javascript:void(0)')

瀏覽器的用戶代理為：

user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 –