The easiest and safest way to avoid the rather strange restrictions described is to not make use of inline script in a way that makes those restrictions neccess

The easiest and safest way to avoid the rather strange restrictions described is to not make use of inline script in a way that makes those restrictions neccessary, though. And a "recommendation" should reflect that (from back when HTML recommendations were actually published rather than random Google shills writing whatever on github). The suggested workaround is also not without criticism (eg [1]). [1]: https://uploadcare.com/blog/vulnerability-in-html-design/ https://uploadcare.com/blog/vulnerability-in-html-design/