On a client's corporate network something is stripping all
<script> elements that contain code, i.e. things like
On the other hand, HTML elements like
<script src="/something.js"></script> aren't getting stripped and run in the browser just fine.
Is there any security benefit from such stripping?
I certainly can't see one... XSS comes to mind, but if someone is going to do a XSS attack, they'll probably try the variant with
And a side-question: what software could they be using? Or better yet, what can I use to emulate that situation on my Mac or PC where the development happens?