DioxusLabs / DioxusLabs/dioxus

dioxus_liveview::interpreter_glue should not wrap javascript in <script> tag

Open
#736 0 comments 0 reactions 0 assignees View on GitHub
breaking liveview
Dominant language
Rust
Stars
39.1k
Forks
1.9k
Avg merge
4d 10h
Merged PRs (30d)
4

Description

## Specific Demand

`dioxus_liveview::interpreter_glue` will always return a string of javascript wrapped in `` tags. This forces using the glue inline with the HTML, and not as a separate resource. This can cause problems when serving a website with a `Content-Security-Policy` as it is unsafe and unwise to allow un-hashed/un-nonced inline scripts in your page. By not letting the user create the script tags, these attributes are very hard if not impossible to add to the script tags given. Another use case would be allowing the interpreter glue to be served as a separate asset, for example `https://example.com/glue.js`.

Currently, a workaround is
```rs
dioxus_liveview::interpreter_glue(domain)
.trim_start_matches("\n<script>")
.trim_end_matches("\n ")
.to_string()
```

## Implement Suggestion

Remove the `` tags from the content of the string returned by `dioxus_liveview::interpreter_glue`

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate the dioxus_liveview::interpreter_glue entry point and inspect how its returned JavaScript is assembled. Verify the current output includes the script tags, then update the behavior so the returned string contains only the JavaScript; confirm callers can add their own tags or serve it as a separate asset.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, rust
Domain
security, web-dev
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.