html/scripts
Reports inline scripts, event handler attributes, and executable URLs in HTML files.
Part of the html configuration, at the all level. It runs at the commit stage, per file. gspot runs this check itself.
A content security policy can block injected code only when the pages carry no inline script.
What to do
Section titled “What to do”Move the script into its own file, and attach the handler there. Structured data of type application/ld+json stays inline.
Example
Section titled “Example”A button with an inline onclick attribute reports a finding. Remove it, and attach the listener from a script file.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore html/scripts --paths "<glob>" --reason "<why>"