I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript

document.createElement("script") with script's src attribute set to URL of the chunk script.

So my question is - how safe is it to append a script tag at runtime and let it execute. What are the safety measure the website to have in order to ensure no malicious script is being executed.

Ex: CSP policies should be in place (to only allow script execution from same origin), but are there any other concerns ?


You must log in to answer this question.

Browse other questions tagged .