# Is it safe to paste a script from an old tutorial site?

Source: https://codelifter.com/forum/posts/is-it-safe-to-paste-a-script-from-an-old-tutorial-site/
Site: CodeLifter Forum, category Script Shelf
Published: 2026-10-16. Updated: 2026-11-04. Replies: 2.

## Question by CodeLifter editors (staff), 2026-10-16

Reading it is safe, pasting it unchanged is a manageable risk, and linking to the copy on the old site is the real danger. Copy the code into your own file, read every line for what it loads and writes into the page, check the licence, and never point a script tag at a host you do not control.

## The three questions to ask of any old snippet

An old tutorial script can hurt you in three different ways, and each has its own check.

1. **What does it load?** Any `<script src>`, `<link href>`, image or `fetch()` pointing at another host makes that host part of your page.
2. **What does it write into the page?** Code that turns strings into HTML or code can run whatever ends up in those strings.
3. **What are you allowed to do with it?** Code with no licence is still somebody's copyright.

A script can pass one question and fail another. A clean ten-line function with no licence is safe to run and not yours to republish.

## Never hotlink the old site

Old tutorials often say "add this line to your page" with a `src` on the tutorial's own domain. Do not. Whoever controls that host controls what runs on your page. MDN's [Subresource Integrity page](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity) describes the risk directly: if an attacker gains control of the third-party host, they can inject arbitrary content into its files or replace them completely. Old hobby domains change hands when they lapse, so the person serving that file next year may not be the person who wrote the tutorial.

Do this instead:

1. Open the script URL in your browser and save the file into your project, for example `js/legacy-quote.js`.
2. Read it (see the next section).
3. Load your copy: `<script src="/js/legacy-quote.js"></script>`.

If you must load a file from someone else's server, for example a library on a CDN, pin it with an `integrity` hash and `crossorigin="anonymous"`. MDN gives an OpenSSL command that produces the hash:

```bash
cat legacy-quote.js | openssl dgst -sha384 -binary | openssl base64 -A
```

Prefix the output with `sha384-`. If the file on the server changes by a single byte, the browser refuses to run it and reports a network error. MDN adds that the server has to send CORS headers for this to work, so a plain personal host may not support it at all; that is one more reason to keep a local copy.

Very old tutorials also link scripts over `http://`. On an HTTPS page that request is blocked as [mixed content](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Mixed_content), so the script silently never loads. Changing the URL to `https://` is not a fix if the copy behind it is not the one you read.

## Read it for the risky lines

Search the file for these, then read the surrounding code:

| What you find | Why it matters | What to do |
|---|---|---|
| `innerHTML`, `outerHTML`, `insertAdjacentHTML` | Parses a string as HTML, so any markup in it becomes live | Use `textContent` for text, `createElement` for structure |
| `document.write()` | MDN calls it an injection sink and a possible XSS vector, and it is deprecated | Rewrite with DOM methods |
| `eval()`, `new Function()`, `setTimeout("string")` | Runs a string as code | Pass a function instead |
| A URL to another host | That host is now part of your page | Copy the file locally, or pin it with SRI |
| `http://` | Blocked on HTTPS pages, or fetched without encryption | Use a local copy |
| `document.cookie`, form values sent anywhere | The snippet touches visitor data | Find out where it goes before you keep it |

The [innerHTML thread](/forum/posts/how-do-i-stop-a-coding-assistant-from-using-innerhtml/) covers the same pattern when it comes from an assistant rather than a tutorial, and the fix is the same.

## Check the licence before you ship

Many old tutorial pages never stated a licence. GitHub's [guide to licensing a repository](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository) states the default plainly: without a licence, no one may reproduce, distribute or create derivative works from the work. Some old sites had terms that allowed reuse with a credit comment; if so, keep the comment and note where you found the terms. If you cannot find any terms, treat the snippet as a description of a technique and write your own version. [Snippet licensing](https://codelifter.com/provenance/snippet-licensing/) goes through Stack Overflow, MDN and GitHub cases in more detail.

Whatever you keep, write down where it came from: the URL, the date you copied it, what you changed and what licence applied. The [provenance record thread](/forum/posts/what-should-a-provenance-record-for-copied-code-include/) lists the fields.

## Or skip the old copy

For the classic jobs (go back, random quote, image popup, slideshow, draggable box, mouse position), the [Script Shelf](https://codelifter.com/scripts/) has MIT-licensed rewrites with their origin stated, so the licence question is already answered. For anything else, ask an assistant for the behaviour and then apply the same three questions to what it gives you. Generated code can repeat the same old patterns, and [whether old scripts still run at all](/forum/posts/do-old-cut-and-paste-scripts-still-work-in-current-browsers/) is a separate check worth doing too.

## Reply 1 by CodeLifter editors (staff), 2026-11-01

**Will a Content Security Policy block an old pasted script?** Very likely, and that is a good thing to find out on purpose. MDN's [CSP guide](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) says that if a policy has a `default-src` or `script-src` directive, inline JavaScript is not allowed to run unless extra measures are taken. That covers code inside a `<script>` element in the page, inline event handler attributes such as `onclick` or `onerror`, and `javascript:` URLs, which are three of the most common patterns in old tutorials. The same applies to `eval()` and similar APIs, which MDN lists as including the `Function()` constructor and string arguments to `setTimeout()` and `setInterval()`. The `'unsafe-inline'` and `'unsafe-eval'` keywords switch the protection back off, and MDN tells developers to avoid both, because inline JavaScript is one of the most common XSS vectors. The practical path for an old snippet is the one in the opening post: move it into your own `.js` file, replace each `onclick="..."` attribute with `addEventListener`, and remove any string evaluation. Then a policy such as `script-src 'self'` lets your copy run and blocks the rest. If a script only works with `'unsafe-inline'`, treat that as a list of lines still to rewrite.

## Reply 2 by CodeLifter editors (staff), 2026-11-04

**Can a linter find the risky lines in an old script?** It can find several of them, quickly. ESLint has core rules for the patterns in the table above. [no-eval](https://eslint.org/docs/latest/rules/no-eval) reports every use of `eval()`, including indirect calls such as `(0, eval)("...")` unless you set its `allowIndirect` option. [no-implied-eval](https://eslint.org/docs/latest/rules/no-implied-eval) reports `setTimeout()` and `setInterval()` called with a string as the first argument, and `execScript()`, which was Internet Explorer only; ESLint's page explains that passing a function is safer and faster. Both are worth turning on for any folder of copied code:

```
// eslint.config.mjs
export default [{ files: ["js/legacy-*.js"], rules: { "no-eval": "error", "no-implied-eval": "error" } }];
```

Run `npx eslint js/` and fix what it reports. For `innerHTML` and `insertAdjacentHTML`, add Mozilla's no-unsanitized plugin, set up in the [innerHTML thread](/forum/posts/how-do-i-stop-a-coding-assistant-from-using-innerhtml/). A linter reads code, not intent, so it will not tell you where `fetch()` sends a cookie or which host a `src` points at. Keep the manual search for other domains and `http://`, and read those lines yourself.

---
Cite as: CodeLifter Forum, "Is it safe to paste a script from an old tutorial site?", https://codelifter.com/forum/posts/is-it-safe-to-paste-a-script-from-an-old-tutorial-site/, accessed 2026-11-12.