I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript
document.createElement("script") with script's src attribute set to URL of the chunk script.
So my question is - how safe is it to append a script tag at runtime and let it execute. What are the safety measure the website to have in order to ensure no malicious script is being executed.
Ex: CSP policies should be in place (to only allow script execution from same origin), but are there any other concerns ?
