winters27_obsidian-byoc/scripts/strip-script-injection.cjs
winters27 34c68cd0ad fix(build): emit a single bundle and strip vendor script injection
Obsidian review flagged 3 dynamic script element creations. All were
bundled vendor dead code: webpack's JSONP chunk loader and localforage's
legacy-IE microtask polyfill. Merge everything into main.js
(LimitChunkCountPlugin plus splitChunks/runtimeChunk off) to drop the
JSONP runtime, and add a localforage-scoped loader that rewrites the
unreachable createElement script branch. Remove the stale 927.main.js
chunk artifact.
2026-06-16 11:18:37 -07:00

14 lines
837 B
JavaScript

// webpack loader scoped to localforage.
//
// localforage bundles the `immediate` microtask scheduler, which feature-detects
// legacy IE by reading `onreadystatechange` off a freshly created <script> element.
// That branch is unreachable in Electron (MutationObserver is selected first), but
// the literal `createElement("script")` is a static string in the bundle, which
// Obsidian's plugin review flags as dynamic script injection.
//
// Rewriting the element tag in this dead branch removes the flagged construct
// without changing runtime behavior: the scheduler never reaches this path, and
// even if it did, the detection simply falls through to the timer-based fallback.
module.exports = function stripScriptInjection(source) {
return source.replace(/createElement\(\s*(["'])script\1\s*\)/g, 'createElement("span")');
};