External app/script pulling, and Data-AJAX removal of custom scripts

[DMcDona]

Hi all,

We're looking at ways to pull a web app/page created outside of our CMS into a page existing within our CMS.

Originally, the plan was to use the data-ajax plugin to accomplish this, however release 10.0.4 made it that custom scripts and css are sanitized with data-ajax.

An alternative that has been raised is to use the data-ajax to pull in the HTML content and link to the script file with either the good old <script src="...."></script> or with Jquery's $.getScript. However, we're questioning if the data-ajax sanitizing is to solve a security risk which these would expose?

Thanks so much!