fix(scripts): privacy default attributes

unjs · Apr 12, 2024 · e2ba513 · e2ba513
1 parent 8c69596
commit e2ba513
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 3 deletions.
diff --git a/packages/unhead/src/composables/useScript.ts b/packages/unhead/src/composables/useScript.ts
@@ -1,6 +1,7 @@
 import { ScriptNetworkEvents, hashCode } from '@unhead/shared'
 import type {
   DomRenderTagContext,
+  Head,
   ScriptInstance,
   UseScriptInput,
   UseScriptOptions,
@@ -21,6 +22,7 @@ export function useScript<T>(_input: UseScriptInput, _options?: UseScriptOptions
   if (!head)
     throw new Error('Missing Unhead context.')
 
+  const isAbsolute = input.src && (input.src.startsWith('http') || input.src.startsWith('//'))
   const id = input.key || hashCode(input.src || (typeof input.innerHTML === 'string' ? input.innerHTML : ''))
   const key = `use-script.${id}`
   if (head._scripts?.[id])
@@ -66,9 +68,17 @@ export function useScript<T>(_input: UseScriptInput, _options?: UseScriptOptions
     load() {
       if (!script.entry) {
         syncStatus('loading')
+        const defaults: Required<Head>['script'][0] = {
+          defer: true,
+          fetchpriority: 'low',
+        }
+        if (isAbsolute) {
+          defaults.crossorigin = 'anonymous'
+          defaults.referrerpolicy = 'no-referrer'
+        }
         // status should get updated from script events
         script.entry = head.push({
-          script: [{ defer: true, fetchpriority: 'low', ...input, key }],
+          script: [{ ...defaults, ...input, key }],
         }, options)
       }
       return loadPromise

diff --git a/test/unhead/dom/useScript.test.ts b/test/unhead/dom/useScript.test.ts
@@ -13,7 +13,7 @@ describe('dom useScript', () => {
     expect(await useDelayedSerializedDom()).toMatchInlineSnapshot(`
       "<!DOCTYPE html><html><head>
 
-      <script data-onload="" data-onerror="" defer="" fetchpriority="low" src="https://cdn.example.com/script.js" data-hid="438d65b"></script></head>
+      <script data-onload="" data-onerror="" defer="" fetchpriority="low" crossorigin="anonymous" referrerpolicy="no-referrer" src="https://cdn.example.com/script.js" data-hid="438d65b"></script></head>
       <body>
 
       <div>

diff --git a/test/unhead/ssr/useScript.test.ts b/test/unhead/ssr/useScript.test.ts
@@ -36,7 +36,7 @@ describe('dom useScript', () => {
         "bodyAttrs": "",
         "bodyTags": "",
         "bodyTagsOpen": "",
-        "headTags": "<script defer fetchpriority="low" src="https://cdn.example.com/script.js" onload="this.dataset.onloadfired = true" onerror="this.dataset.onerrorfired = true" data-hid="438d65b"></script>",
+        "headTags": "<script defer fetchpriority="low" crossorigin="anonymous" referrerpolicy="no-referrer" src="https://cdn.example.com/script.js" onload="this.dataset.onloadfired = true" onerror="this.dataset.onerrorfired = true" data-hid="438d65b"></script>",
         "htmlAttrs": "",
       }
     `)