scripts #30
Comments
|
Hey,
Honestly, I don't really feel comfortable allowing arbitrary evaluation or injection of scripts The other things should be possible, #31 |
|
The problem is that most trackers require an inline script as well as a regular script. So this solution would not be enough. Also, since you're adding the script elements via DOM manipulation, I believe there's no need to eval, the browser will honor the script tag anyway? Other than that, the PR looks great! |
|
I wonder if the inline use-case could be adequately addressed using data-uris, like: useScript({ src: 'data:application/javascript,alert("yolo")' });
|
|
Great idea! |
|
@JoviDeCroock, should |
|
Ah damn, forgot about that 😅 |
I'm currently using Helmet but I do prefer the hooks approach you offer.
One thing I'm missing is
<script>support. It's nice to be able to encapsulate trackers and other scripts that have to go in<head>for technical reasons so they can be placed where they make sense in the application.Helmet's support for
<script>is very rudimentary IMHO - it just adds the tag without regards for SSR-rendered previous tags, and if you put in an inline script, it won't run it, so that will only work for SSR.So, ideally, hoofd would:
evalinline scripts when run in the browser, but add them to<head>when run during SSRBut, I would already be happy with simply supporting the tag.
The text was updated successfully, but these errors were encountered: