From 0a73181ea7c2ac122e0b57a4ca95ad5cdc3b8c12 Mon Sep 17 00:00:00 2001 From: Steve Hanlon Date: Tue, 17 Feb 2026 09:28:11 +0000 Subject: [PATCH] Refactor script injection to type="text/plain" inert pattern Custom scripts are now rendered as inert ' . "\n"; + } + } + + return $output; + } } diff --git a/public/js/consent-manager.js b/public/js/consent-manager.js index 4997e97..b99333e 100644 --- a/public/js/consent-manager.js +++ b/public/js/consent-manager.js @@ -129,32 +129,68 @@ var AttConsent = (function() { /** * Execute custom scripts for the consented categories. + * Scans the DOM for inert type="text/plain" script tags and template tags + * with matching data-att-cc-category attributes, then activates them. * * @param {Object} categories Consent categories. */ function executeConsentedScripts(categories) { - var scripts = config.scripts || {}; + var cats = Object.keys(categories).filter(function(cat) { + return categories[cat]; + }); + if (!cats.length) return; - Object.keys(categories).forEach(function(cat) { - if (!categories[cat] || !scripts[cat]) { + var selectors = []; + cats.forEach(function(cat) { + selectors.push('script[type="text/plain"][data-att-cc-category="' + cat + '"]'); + selectors.push('template[data-att-cc-category="' + cat + '"][data-att-cc-type="html"]'); + }); + + var elements = document.querySelectorAll(selectors.join(',')); + Array.prototype.slice.call(elements).forEach(function(el) { + if (el.nodeName === 'SCRIPT') { + activateScript(el); + } else if (el.nodeName === 'TEMPLATE') { + activateTemplate(el); + } + }); + } + + /** + * Activate an inert script element by creating a fresh