I understand that dynamically appending a script tag to DOM could lead to XSS attacks if script's URL isn't properly secured and
my.remote.domain.com isn't whitelisted as an allowed domain to load and execute scripts from.
Example (code running on
var myScript = document.createElement('script'); myScript.src = 'https://my.remote.domain.com/path/to/myScript.js'; document.head.appendChild(myScript);
However when I ran CSP Mitigator tool, it didn't complain about having these script tags attached. Is it because such tool can only run and inspect DOM elements rather than read through scripts code as well ? And if so, are there good tools out there to detect such code issues ?