GoDaddy injecting JavaScript into websites and how to stop it
I think it's pretty unfortunate that even now, CSPs are getting so little love in the comments of a post where they would have easily prevented this script from loaded at all, and could have helped the author discover the script the second it was added.For the unitiated, Content Security Policies (CSP) allow you to, among other things, define a whitelist of origins for things like scripts, css etc. and also notify you of violations. There is little excuse to not set a strong CSP on your sites if you can and you'll be glad you have it once something does happen.