title: Why a simple button tag gives a CSP violation?
body: <p>I know it sounds strange, but it took me 3 hours to check it. A simple HTML</p>
  
  <pre><code>&lt;button&gt;&lt;/button&gt;
  </code></pre>
  
  <p>was returning either in Firefox or Chrome</p>
  
  <pre><code>Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src”).
  </code></pre>
  
  <p>with no extra information, no lines, no file, nothing. I replaced by a <code>&lt;input type="button"/&gt;</code> with the same CSS and now it works.</p>
  
  <p>Just for the record, my CSP 'script-src' rules were</p>
  
  <pre><code>script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa' 'strict-dynamic' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.google-analytics.com/analytics.js https://api.uber.com https://cdnjs.cloudflare.com/ajax/libs/jsSocials/1.5.0/jssocials.min.js
  </code></pre>