script action and security

[JoernT]

This is a tricky one...

The ultimate wayout when hitting limitations with the available functionality is to call some javascript. This is also interesting when integrating with custom components.

Of course script could be given inline...

<fx-action type="text/javascript">
    const foo = ....
</fx-action>

However this must be considered a risk as it's too easy to inject some script into the page. Thus it is commonly strongly advised to avoid inline script completely.

Currently Fore supports to link to an external script like this:

<fx-action src="test.js"></fx-action>

This works but is certainly not very convenient esp. when just a single call to a component is wanted which is often the case when integrating arbitrary components with forms.

What else can be done to securely call script?

[JoernT]

silly question - obviously CSP is the answer.

At least an example for hash-signed inline code would be great