| 2 | | |
| 3 | | In [https://github.com/WordPress/wordpress-develop/pull/498 this] pull request I introduced two new functions that print `<script>` tags and enable attribute injection: |
| 4 | | * wp_print_script_loader_tag: for script tags that load JavaScript files through the src attribute; |
| 5 | | * wp_print_inline_script _tag: for inline scripts. |
| 6 | | Both these functions filter the attributes passed to them through `wp_script_attributes` so that plugins can change script attributes in a controlled manner. |
| 7 | | |
| 8 | | Instead of directly printing `<script>` tags, these functions should be used to ensure that every `<script>` tag is controllable. |
| 9 | | |
| 10 | | In the PR I also included the refactoring of every script tag; now they are printed by either `wp_print_inline_script_tag` or `wp_print_script_loader_tag`. I followed [https://csp.withgoogle.com/docs/adopting-csp.html this] guide on adopting CSP, considering the `strict-dynamic` option enabled. |
| 11 | | I made a [https://github.com/enricocarraro/wp-strict-csp plugin prototype] that enables Strict CSP to test these changes. |
| 12 | | |
| 13 | | |
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
