[Blazor] Security - interactive-server-side-rendering - script tags

[hakenr]

Script tags aren't allowed and shouldn't be included in the app's component render tree. If a script tag is included in a component's markup, a compile-time error is generated.

I'm not aware of any such compile-time behavior.
While it's not recommended to include script tags in your interactive components (since the behavior can be tricky), there's no built-in mechanism that prevents you from including a script tag in the render tree.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/blazor/security/interactive-server-side-rendering.md	Threat mitigation guidance for ASP.NET Core Blazor interactive server-side rendering

[guardrex]

This goes back to the inception of the article five years ago on #13962, written by Javier and reviewed by Steve Sanderson and Ryan Nowak when he worked on Blazor. It's at Line 194 of ...

https://github.com/dotnet/AspNetCore.Docs/pull/13962/files#diff-4962dbf450346ed225e83e082be3ddbae62e523fd1980145aa2af347ec62a2eaR194

Stand-by while I get them on here to take a look.