Which Content-Security-Policy stops an injected <img src=x onerror=alert(1)> from running script while still allowing your own scripts?

The nonce-based policy is correct. An inline event handler like onerror only runs if the policy allows inline script. A nonce-based policy allows only the scripts that carry the random nonce for this response. The injected <img> has no nonce, so its handler doesn't run. 'strict-dynamic' lets your trusted scripts load their own dependencies.

"script-src 'self' 'unsafe-inline'" is wrong, and so is "script-src 'self'; script-src-attr 'unsafe-inline'". 'unsafe-inline', in either script-src or script-src-attr, turns back on exactly the injected handler you want to block. "default-src *" allows everything.