A possible solution: .js files should be hashed and, html should indicate the hashes of the .js files it uses. The browser than could run only scripts from a al

A possible solution: .js files should be hashed and, html should indicate the hashes of the .js files it uses. The browser than could run only scripts from a allowed list.