DioxusLabs / DioxusLabs/dioxus
dioxus_liveview::interpreter_glue should not wrap javascript in <script> tag
- Dominant language
- Rust
- Stars
- 39.1k
- Forks
- 1.9k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 4
Description
## Specific Demand
`dioxus_liveview::interpreter_glue` will always return a string of javascript wrapped in `` tags. This forces using the glue inline with the HTML, and not as a separate resource. This can cause problems when serving a website with a `Content-Security-Policy` as it is unsafe and unwise to allow un-hashed/un-nonced inline scripts in your page. By not letting the user create the script tags, these attributes are very hard if not impossible to add to the script tags given. Another use case would be allowing the interpreter glue to be served as a separate asset, for example `https://example.com/glue.js`.
Currently, a workaround is
```rs
dioxus_liveview::interpreter_glue(domain)
.trim_start_matches("\n<script>")
.trim_end_matches("\n ")
.to_string()
```
## Implement Suggestion
Remove the `` tags from the content of the string returned by `dioxus_liveview::interpreter_glue`
Contributor guide
No contributing guide indexed for this repository
Research direction
Locate the dioxus_liveview::interpreter_glue entry point and inspect how its returned JavaScript is assembled. Verify the current output includes the script tags, then update the behavior so the returned string contains only the JavaScript; confirm callers can add their own tags or serve it as a separate asset.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, rust
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100