To be clear, the main goal here is to remove the risk of unexpected changes (including compromise) of the part of the JavaScript that necessarily has access to the parent document context before establishing the iframes that the rest of the code is then loaded into.

We should consider doing this for improved auditability, especially if/when the contents change.

The auditability benefit here is when compared to the other ways we might address this risk (inlining the JS inside our other existing files, or using Subresource Integrity to protect the code from a 3P origin).

Change #1185314 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@master] WIP: Use ResourceLoader for secure-api.js

https://gerrit.wikimedia.org/r/1185314

For licensing reasons, as discussed in 1185314 (and to my knowledge as well), we are unable to host any proprietary code to our repos. I am afraid, same principle applies to our puppet repo as well.

We don't have a clear path forwards on this right now. T404251: hCaptcha: Enable version pinning and subresource integrity is implemented, however.

Change #1185314 abandoned by Kosta Harlan:

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Use ResourceLoader for locally-hosted secure-api.js

Reason:

Abandoning this for now

https://gerrit.wikimedia.org/r/1185314