Gallery 2.5.0 — scripts from GalleryHelper::drawScripts() bypass the Joomla document and break nonce-based CSP

Hello,
We have an active Gallery subscription and run the component on around 50
Joomla sites. We are rolling out Content-Security-Policy across all of them
and have hit a blocker in Gallery that we cannot solve from outside the
component, so we would like to ask for a change on your side.

ENVIRONMENT
Joomla 5.4.x/6.1.x, PHP 8.4, Gallery 2.5.0
CSP published through Joomla's core "System - HTTP Headers" plugin,
with the Nonce option enabled.

THE ISSUE

Balbooa\Component\Gallery\Site\Helper\GalleryHelper::drawScripts()
(components/com_gallery/src/Helper/GalleryHelper.php, from line 229) builds
its script tags as raw HTML strings and returns them for output in the page
body:

$html .= '';

Because those tags never pass through the Joomla document, they are not
processed by ScriptsRenderer, which is where Joomla attaches the CSP nonce
to script tags (HtmlDocument::$cspNonce, populated from
$app->get('csp_nonce') through CMSApplication's document options).

Six tags in that method are affected:

line 253 media/vendor/jquery/js/jquery.min.js
line 259 inline: var JUri = ..., gallery_image_path=...
line 261 libraries/modal/ba_modal.js
line 267 libraries/ba_isotope/ba_isotope.js
line 269 libraries/lazyload/jquery.lazyload.min.js
line 271 assets/js/ba-gallery.js

Under a nonce-based policy all six are refused and the gallery stops working
on every page that uses it. The two tags in the same
block are fine, since style-src covers them via 'self'.

WHY WE CANNOT WORK AROUND IT
- Allow-listing the host does not help. A nonce-based policy uses
'strict-dynamic', and browsers then ignore 'self' and every host listed in
script-src by design. Only nonced scripts execute.
- The inline tag on line 259 cannot be allow-listed at all without
'unsafe-inline' on script-src, which would defeat the whole policy.
- There is no template override for a Helper class, so our only option is to
patch your file directly — lost on every update, and to be re-applied on
50 sites.

WHAT WE WOULD LIKE
Either of these would solve it for us.
Option A — minimal, one method touched. Read the nonce from the application
and add it to each tag:

$nonce = Factory::getApplication()->get('csp_nonce');
$nonceAttr = $nonce ? ' nonce="' . $nonce . '"' : '';
...
$html .= '';

Factory is already imported in that file (line 18). The ternary keeps the
output byte-identical on sites without CSP, so this is fully backwards
compatible.

Option B — the idiomatic route. Register the files through the
WebAssetManager and the inline snippet via addInlineScript() /
addScriptOptions(), letting Joomla render them. The nonce then comes for
free, and you also gain dependency and load-order handling. We understand
this is a larger change that may affect script ordering, so Option A is
entirely sufficient for our needs.

ALSO WORTH CHECKING

The same raw-tag pattern appears in src/Controller/GalleryController.php
(lines 405 and 514) and in tmpl/gallery/default.php (lines 53-59). We have
not exercised those code paths under CSP, but they will most likely need the
same treatment.

We are happy to test a patched build across our sites and report back.

Thank you,