private void validate(String nonce) throws CspException {
        if (LangUtils.isEmpty(nonce)) {
            throw new CspException("Missing CSP nonce");
        }
        try {
            String decodedNonce = new String(Base64.getDecoder().decode(nonce), StandardCharsets.UTF_8);
            UUID.fromString(decodedNonce);
        }
        catch (Exception e) {
            throw new CspException("Invalid CSP nonce", e);
        }
    }
Currently the script nonce is user-supplied input, so we have to validate it to prevent header/XSS injections.

@param nonce the nonce to validate
@throws CspException if any errors validating the nonce
primefaces/src/main/java/org/primefaces/csp/CspState.java