security-live / tts.bot

tts.bot
17 stars 6 forks source link

Load js from file #18

Closed REG-GIE closed 1 year ago

REG-GIE commented 1 year ago

To make it easier to restrict injected arbitrary code by disallowing inlined JS code completely, it is necessary to move the purposely inlined code into an external file. There is the alternative by generating hashes for inlined scripts, but that would require an update on every change.

We should maybe merge all the changes that are currently in progress first and then I'll update it or there will be a merge conflict.

closes: #17