daattali / daattali/shinyjs

Possible to move inline scripts to a .js file for easier CSP implementations?

Open
#274 6 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
R
Stars
751
Forks
118
PR merge metrics
No merged PRs in 30d

Description

Not sure if this is even possible, but I thought it is worth to ask.

When calling `shinyjs::useShinyjs`, many functions are injected inline in the UI. This is a problem when implementing a strict CSP for a Shiny web application, since inline scripts are blocked by default. Would it be possible that these functions are loaded by calling a script file in the package `inst` folder instead of injecting them inline? Maybe using a variant of the `inject.js` script that was previously present in the package, to create the needed calls dynamically?

May be related to #101

On a sidenote: I suspect that the documentation on how to include `shinyjs` using a HTML template is outdated, since the function `inject.js` is not included in the package anymore: https://github.com/daattali/shinyjs/blob/0648faa0dc985a5be55bbc745fe042056a0ecfc3/vignettes/shinyjs-usage.Rmd#L167

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing shinyjs::useShinyjs and the package's inst folder, then compare the current implementation with the previously referenced inject.js script. Check the HTML-template guidance in vignettes/shinyjs-usage.Rmd and issue #101. Done means determining a non-inline loading approach that supports strict CSP and updating documentation if it is outdated.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, r
Domain
documentation, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.