Linter Rule: Disallow inline script elements

Rule: html-no-inline-script-elements

Description

Disallow the use of inline <script> tags in HTML templates.

Rationale

Inline JavaScript poses a significant security risk and is incompatible with strict Content Security Policy (CSP) configurations (script-src 'self').

All JavaScript should be included via external assets to support strong CSP policies that prevent cross-site scripting (XSS) attacks.

This rule enforces:

• No <script> tags embedded directly in templates.

Examples

✅ Good

<%= javascript_include_tag "application" %>
Missing a `nonce` attribute on `<script>` tag. Use `request.content_security_policy_nonce`. (html-require-script-nonce)

<script type="application/json">
Avoid using `application/json` as the `type` attribute for the `<script>` tag. Must be one of: `text/javascript`, `module`, `importmap`, `speculationrules`, `application/ld+json` or blank. (html-allowed-script-type)
  {"key": "value"}
</script>

<script type="application/ld+json">
  {"@context": "https://schema.org"}
</script>

🚫 Bad

<script>
Missing a `nonce` attribute on `<script>` tag. Use `request.content_security_policy_nonce`. (html-require-script-nonce)
  alert("Hello, world!")
</script>

<script type="text/javascript">
Missing a `nonce` attribute on `<script>` tag. Use `request.content_security_policy_nonce`. (html-require-script-nonce)
  console.log("Hello")
</script>

References

• Inspired by @pushcx
• MDN: Content Security Policy (CSP)