daattali/shinyjs

Possible to move inline scripts to a .js file for easier CSP implementations?

Open

#274 opened on Oct 9, 2024

View on GitHub
 (6 comments) (0 reactions) (0 assignees)R (521 stars) (104 forks)batch import
enhancementhelp wanted

Description

Not sure if this is even possible, but I thought it is worth to ask.

When calling shinyjs::useShinyjs, many functions are injected inline in the UI. This is a problem when implementing a strict CSP for a Shiny web application, since inline scripts are blocked by default. Would it be possible that these functions are loaded by calling a script file in the package inst folder instead of injecting them inline? Maybe using a variant of the inject.js script that was previously present in the package, to create the needed calls dynamically?

May be related to #101

On a sidenote: I suspect that the documentation on how to include shinyjs using a HTML template is outdated, since the function inject.js is not included in the package anymore: https://github.com/daattali/shinyjs/blob/0648faa0dc985a5be55bbc745fe042056a0ecfc3/vignettes/shinyjs-usage.Rmd#L167

Contributor guide

Tech stack
javascript
Domain
frontend
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
understanding of CSPfamiliarity with shinyjs package structure
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the current implementation of useShinyjs() to understand how inline scripts are injected. Look at the old inject.js script (mentioned in #101) to see how it previously handled dynamic calls. Consider moving the inline JavaScript to a separate .js file in the inst/ directory and referencing it via a script tag. Also update the vignette documentation on HTML templates to reflect the removal of inject.js. Check the related issue #101 for context on previous attempts.