From 3dbb5f067f5b11c86c87bde60d167db8ec4beb11 Mon Sep 17 00:00:00 2001 From: Patrick McCann Date: Mon, 24 Aug 2026 17:18:55 -0400 Subject: [PATCH] Fix for Call to eval-like DOM function Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .../51DegreesRtdProvider_pageIntegration_example.html | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/integrationExamples/gpt/51DegreesRtdProvider_pageIntegration_example.html b/integrationExamples/gpt/51DegreesRtdProvider_pageIntegration_example.html index 8f886057ff9..640f8fd0ad0 100644 --- a/integrationExamples/gpt/51DegreesRtdProvider_pageIntegration_example.html +++ b/integrationExamples/gpt/51DegreesRtdProvider_pageIntegration_example.html @@ -13,10 +13,12 @@ // Delegate-CH must be written before the script tag below, so that the // high-entropy client hints are delegated to whichever origin is in // play. A static meta would pin this to one deployment. - document.write(''); + var delegateChContent = ['sec-ch-ua-full-version-list', 'sec-ch-ua-model', 'sec-ch-ua-platform', 'sec-ch-ua-platform-version'] + .map(function (h) { return h + ' ' + CLOUD_ORIGIN; }).join('; '); + var delegateChMeta = document.createElement('meta'); + delegateChMeta.setAttribute('http-equiv', 'Delegate-CH'); + delegateChMeta.setAttribute('content', delegateChContent); + (document.head || document.getElementsByTagName('head')[0]).appendChild(delegateChMeta); // PMP localStorage contract, mirroring resolveIdUsage() in // modules/51DegreesRtdProvider.js. The page owns this read because in