Secure way of inserting dynamic values in external JavaScript files

Question

I\'m implementing Content Security Policy headers using the following policy

Content-Security-Policy: default-src \'self\'

so will need to avoid

Answer 1

$('#@ViewData.TemplateInfo.GetFullHtmlFieldName(string.Empty)')

Yeah this isn't a good approach in general. Razor will HTML-escape by default but the context isn't simply HTML here, it's:

• an identifier, inside
• a CSS selector, inside
• a JavaScript string literal, inside
• a JavaScript statement, inside
• an HTML CDATA element (