Possible to move inline scripts to a .js file for easier CSP implementations?
- Dominant language
- R
- Stars
- 751
- Forks
- 118
- PR merge metrics
- No merged PRs in 30d
Description
Not sure if this is even possible, but I thought it is worth to ask.
When calling `shinyjs::useShinyjs`, many functions are injected inline in the UI. This is a problem when implementing a strict CSP for a Shiny web application, since inline scripts are blocked by default. Would it be possible that these functions are loaded by calling a script file in the package `inst` folder instead of injecting them inline? Maybe using a variant of the `inject.js` script that was previously present in the package, to create the needed calls dynamically?
May be related to #101
On a sidenote: I suspect that the documentation on how to include `shinyjs` using a HTML template is outdated, since the function `inject.js` is not included in the package anymore: https://github.com/daattali/shinyjs/blob/0648faa0dc985a5be55bbc745fe042056a0ecfc3/vignettes/shinyjs-usage.Rmd#L167
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing shinyjs::useShinyjs and the package's inst folder, then compare the current implementation with the previously referenced inject.js script. Check the HTML-template guidance in vignettes/shinyjs-usage.Rmd and issue #101. Done means determining a non-inline loading approach that supports strict CSP and updating documentation if it is outdated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, r
- Domain
- documentation, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100