insertUI() now supports execution of <script> (#3630)

NEWS.md

@@ -21,6 +21,8 @@ shiny development
 
 * Closed tidyverse/dplyr#5552: Compatibility of dplyr 1.0 (and rlang chained errors in general) with `req()`, `validate()`, and friends.
 
+* Closed #1545: `insertUI()` now executes `<script>` tags. (#3630)
+
 * Closed #2955: Input and output bindings previously attempted to use `el['data-input-id']`, but that never worked. They now use `el.getAttribute('data-input-id')` instead. (#3538)
 
 * Closed tidyverse/dplyr#6154: Values from an `actionButton()` had S3 classes in the incorrect order.

srcts/src/shiny/singletons.ts

@@ -1,5 +1,4 @@
 import $ from "jquery";
-import { toLowerCase } from "../utils";
 import type { BindScope } from "./bind";
 
 const reSingleton = /<!--(SHINY.SINGLETON\[([\w]+)\])-->([\s\S]*?)<!--\/\1-->/;
@@ -23,21 +22,30 @@ function renderHtml(
 
   addToHead(processed.head);
   register(processed.singletons);
-  if (where === "replace") {
-    $(el).html(processed.html);
-  } else {
-    let elElements: HTMLElement[];
 
-    if (el instanceof HTMLElement) {
-      elElements = [el];
-    } else {
-      elElements = el.toArray();
-    }
-    $.each(elElements, (i, el) => {
-      // type InsertPosition = "beforebegin" | "afterbegin" | "beforeend" | "afterend"
-      el.insertAdjacentHTML(toLowerCase(where), processed.html);
-    });
+  // N.B. even though the DOM insertion below _could_ be done with vanilla JS,
+  // we intentionally use jQuery so that <script> tags execute.
+  // https://github.com/rstudio/shiny/pull/3630
+  switch (where.toLowerCase()) {
+    case "replace":
+      $(el).html(processed.html);
+      break;
+    case "beforebegin":
+      $(el).before(processed.html);
+      break;
+    case "afterbegin":
+      $(el).prepend(processed.html);
+      break;
+    case "beforeend":
+      $(el).append(processed.html);
+      break;
+    case "afterend":
+      $(el).after(processed.html);
+      break;
+    default:
+      throw new Error("Unknown where position: " + where);
   }
+
   return processed;
 }
 // Take an object where keys are names of singletons, and merges it into