html调用远程文件执行命令,javascript – 使用CDN或外部域在HTML注入内联脚本后执行脚本文件...

If the element has a src content attribute, run these substeps:

Let src be the value of the element’s src attribute.

If src is the empty string, queue a task to fire a simple event named

error at the element, and abort these steps.

Resolve src relative to the element.

If the previous step failed, queue a task to fire a simple event named

error at the element, and abort these steps.

Do a potentially CORS-enabled fetch of the resulting absolute URL,

with the mode being the current state of the element’s crossorigin

content attribute, the origin being the origin of the script element’s

Document, and the default origin behaviour set to taint.

The resource obtained in this fashion can be either CORS-same-origin

or CORS-cross-origin. This only affects how error reporting happens.

For performance reasons, user agents may start fetching the script (as

defined above) as soon as the src attribute is set, instead, in the

hope that the element will be inserted into the document (and that the

crossorigin attribute won’t change value in the meantime). Either way,

once the element is inserted into the document, the load must have

started as described in this step. If the UA performs such

prefetching, but the element is never inserted in the document, or the

src attribute is dynamically changed, or the crossorigin attribute is

dynamically changed, then the user agent will not execute the script

so obtained, and the fetching process will have been effectively

wasted.

Then, the first of the following options that describes the situation

must be followed:

If the element has a src attribute, and the element has a defer

attribute, and the element has been flagged as “parser-inserted”, and

the element does not have an async attribute The element must be added

to the end of the list of scripts that will execute when the document

has finished parsing associated with the Document of the parser that

created the element.

The task that the networking task source places on the task queue once

the fetching algorithm has completed must set the element’s “ready to

be parser-executed” flag. The parser will handle executing the script.

If the element has a src attribute, and the element has been flagged

as “parser-inserted”, and the element does not have an async attribute

The element is the pending parsing-blocking script of the Document of

the parser that created the element. (There can only be one such

script per Document at a time.)

The task that the networking task source places on the task queue once

the fetching algorithm has completed must set the element’s “ready to

be parser-executed” flag. The parser will handle executing the script.

If the element does not have a src attribute, and the element has been

flagged as “parser-inserted”, and either the parser that created the

script is an XML parser or it’s an HTML parser whose script nesting

level is not greater than one, and the Document of the HTML parser or

XML parser that created the script element has a style sheet that is

blocking scripts The element is the pending parsing-blocking script of

the Document of the parser that created the element. (There can only

be one such script per Document at a time.)

Set the element’s “ready to be parser-executed” flag. The parser will

handle executing the script.

If the element has a src attribute, does not have an async attribute,

and does not have the “force-async” flag set The element must be added

to the end of the list of scripts that will execute in order as soon

as possible associated with the Document of the script element at the

time the prepare a script algorithm started.

The task that the networking task source places on the task queue once

the fetching algorithm has completed must run the following steps:

If the element is not now the first element in the list of scripts

that will execute in order as soon as possible to which it was added

above, then mark the element as ready but abort these steps without

executing the script yet.

Execution: Execute the script block corresponding to the first script

element in this list of scripts that will execute in order as soon as

possible.

Remove the first element from this list of scripts that will execute

in order as soon as possible.

If this list of scripts that will execute in order as soon as possible

is still not empty and the first entry has already been marked as

ready, then jump back to the step labeled execution.

If the element has a src attribute The element must be added to the

set of scripts that will execute as soon as possible of the Document

of the script element at the time the prepare a script algorithm

started.

The task that the networking task source places on the task queue once

the fetching algorithm has completed must execute the script block and

then remove the element from the set of scripts that will execute as

soon as possible.

Otherwise The user agent must immediately execute the script block,

even if other scripts are already executing. Fetching an external

script must delay the load event of the element’s document until the

task that is queued by the networking task source once the resource

has been fetched (defined above) has been run.