6 ms·> if someone manages to inject arbitrary HTML If they can, why wouldn’t it be inline <script>?by elmigranto 2y ago> if someone manages to inject arbitrary HTML If they can, why wouldn’t it be inline <script>?amluto 2y agoBecause CSP can be configured to block inline scripts.jsheard 2y agoThe syntax to allow inline scripts is even "unsafe-inline" to emphasize that you are entering the danger zone.