Don't use inline scripts and function constructor

[mohe2015]

This allows a stricter Content-Security-Policy which is required for web extensions.

Related #3866 #808 and possibly #1484

[mohe2015]

call to Function() blocked by CSP

There is still something missing

[mohe2015]

dioxus/packages/web/src/document.rs

Line 171 in f610c6b

let result = match Function::new_with_args("dioxus", &code).call1(&JsValue::NULL, &channels)

is the problematic line of code

[mohe2015]

Should be ready now

[ealmloff]

I don't think this will work with fullstack streaming like the suspense-carousel playwright test. We need the script to start running before the html is fully loaded which is why we are using an inline script tag to start the wasm. I think we can set a nonce for the inline script or add the hash of inline script contents to the CSP instead

[mohe2015]

I don't think this will work with fullstack streaming like the suspense-carousel playwright test. We need the script to start running before the html is fully loaded which is why we are using an inline script tag to start the wasm. I think we can set a nonce for the inline script to allow stricter CSPs

That would not work for web extensions (Reading manifest: Error processing content_security_policy.extension_pages: ‘script-src’ directive contains a forbidden 'nonce-*' keyword) but now I understand why the script needs to start running before the html is fully loaded.

It seems that loading the module script asynchronously is possible and seems to pass the test.

[mohe2015]

I don't understand the CI failures here. What do I need to do?

[ealmloff]

CI failures are unrelated dependency issues I'm working on fixing them in #4312

[ealmloff]

Thanks for working on this! The async flag works for fullstack streaming when I tested it. Overall, I think this is a better approach, but there are a few spots that could be refactored a bit

[mohe2015]

Should be ready but I have not tested this yet and don't have more time today.

[mohe2015]

Looked like it works for me.

[ealmloff]

Looks great, thanks! Confirmed this has the right loading behavior for streaming in debug and release mode