Initialization incompatible with require-trusted-types-for 'script' content security policy

[antifuchs]

The script tag generated in

fullstory-browser-sdk/src/snippet.js

Line 24 in bdc424f

o=n.createElement(t);o.async=1;o.crossOrigin='anonymous';o.src='https://'+_fs_script;

does something that we'd like to forbid on our page, in order to properly protect our users from injected javascript: It concatenates untrusted strings.

Ideally, if trusted types are supported in a browser, the library should generate a TrustedScriptURL (or, better - let users pass one) and assign that unchanged.

[antifuchs]

I think this snippet as linked would perfectly support usage with trusted types, if it didn't insist on prepending "https://" to the data provided.