Bug: "link.prev?.setAttribute is not a function" - CSP and <link rel="stylesheet">

[majoer]

Command

build

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

ng build breaks when we combine ngCspNonce with a hard-coded style-sheet link in index.html.

We can replicate this in a new angular app. However, this problem first appeared for us in an Angular Universal app, with the following setup:

• We add ngCspNonce to the app-root as explained in: https://angular.io/guide/security#content-security-policy
• We also add some external style-sheets as links in index.html.

We believe this is where the bug occurs
https://github.com/angular/angular-cli/blob/main/packages/angular_devkit/build_angular/src/utils/index-file/inline-critical-css.ts#L149

Minimal Reproduction

How to reproduce:

1. Run ng new
2. Add ngCspNonce to index.html (nonce is hardcoded for testability)
3. Add a stylesheet link to head: <link rel="stylesheet" href="..." />
4. Run ng build, and see error

Repo with minimal reproduction: https://github.com/majoer/angular-csp-link-bug

Exception or Error

Index html generation failed.
link.prev?.setAttribute is not a function

Your Environment

Angular CLI: 16.1.5
Node: 16.17.0
Package Manager: npm 8.15.0
OS: linux x64

Angular: 16.1.6
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1601.5
@angular-devkit/build-angular   16.1.5
@angular-devkit/core            16.1.5
@angular-devkit/schematics      16.1.5
@angular/cli                    16.1.5
@schematics/angular             16.1.5
rxjs                            7.8.1
typescript                      5.1.6
zone.js                         0.13.1

Anything else relevant?

No response

[alan-agius4]

Duplicate of #25419

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}