The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party LibrariesThe JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries A couple of years back as the US presidential campaign was ramping up, the Trump camp did something stupid. I know, we're all shocked but bear with me because it's an important part of the narrative of this post. One of their developers embedded this code in the campaign's donation website: <script src="https://github
JavaScript in JavaScript (js.js): Sandboxing third-party scripts
eval everything - Running Student Code at Code School
