In certain scenarios I've seen an external script (not one of the ones passed in the list of scripts at initialization) get loaded and start executing. There will always be ways to do this, such as loading the script with $http and eval()ing it, but we should verify that script tags in the page aren't getting executed since the intent is that these will be run only in the browser.
The scenarios seen so far have been analytics tracking scripts, which are pointless to run on the server.
In certain scenarios I've seen an external script (not one of the ones passed in the list of scripts at initialization) get loaded and start executing. There will always be ways to do this, such as loading the script with $http and
eval()ing it, but we should verify that script tags in the page aren't getting executed since the intent is that these will be run only in the browser.The scenarios seen so far have been analytics tracking scripts, which are pointless to run on the server.