fix(scripts): respect user privacy overrides

Author: harlan-zw

packages/unhead/src/scripts/useScript.ts

@@ -144,9 +144,9 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
       const link: RawInput<'link'> = {
         href,
         rel,
-        crossorigin: input.crossorigin || isCrossOrigin ? 'anonymous' : undefined,
-        referrerpolicy: input.referrerpolicy || isCrossOrigin ? 'no-referrer' : undefined,
-        fetchpriority: input.fetchpriority || 'low',
+        crossorigin: typeof input.crossorigin !== 'undefined' ? input.crossorigin : (isCrossOrigin ? 'anonymous' : undefined),
+        referrerpolicy:  typeof input.referrerpolicy !== 'undefined' ? input.referrerpolicy : (isCrossOrigin ? 'no-referrer' : undefined),
+        fetchpriority: typeof input.fetchpriority !== 'undefined' ? input.fetchpriority : 'low',
         integrity: input.integrity,
         as: rel === 'preload' ? 'script' : undefined,
       }

packages/vue/test/unit/useScript.test.ts

@@ -1,8 +1,11 @@
 import { createHead } from '@unhead/vue/client'
+import { renderSSRHead } from '@unhead/vue/server'
+
 import { describe, it } from 'vitest'
 import { ref, watch } from 'vue'
 import { useDom } from '../../../unhead/test/util'
 import { useScript } from '../../src/scripts/useScript'
+import { createHeadCore } from '../../src'
 
 describe('vue e2e scripts', () => {
   it('multiple active promise handles', async () => {
@@ -113,4 +116,50 @@ describe('vue e2e scripts', () => {
     expect(status.value).toEqual('loading')
     expect(status2.value).toEqual('loading')
   })
+
+  it('respects useScript privacy controls - #293', async () => {
+    const head = createHeadCore()
+    const script = useScript({
+      src: 'https://s.kk-resources.com/leadtag.js',
+      async: true,
+      crossorigin: false,
+    }, {
+      head,
+    })
+    const ssr = await renderSSRHead(head)
+    expect(ssr.headTags.replace('>', '').split(' ').sort()).toMatchInlineSnapshot(`
+      [
+        "<link",
+        "as="script"",
+        "fetchpriority="low"",
+        "href="https://s.kk-resources.com/leadtag.js"",
+        "referrerpolicy="no-referrer"",
+        "rel="preload"",
+      ]
+    `)
+    script.remove()
+  })
+  it('respects useScript privacy controls', async () => {
+    const head = createHeadCore()
+    const script = useScript({
+      src: 'https://s.kk-resources.com/leadtag.js',
+      crossorigin: 'use-credentials',
+      referrerpolicy: 'no-referrer-when-downgrade',
+    }, {
+      head,
+    })
+    const ssr = await renderSSRHead(head)
+    expect(ssr.headTags.replace('>', '').split(' ').sort()).toMatchInlineSnapshot(`
+      [
+        "<link",
+        "as="script"",
+        "crossorigin="use-credentials"",
+        "fetchpriority="low"",
+        "href="https://s.kk-resources.com/leadtag.js"",
+        "referrerpolicy="no-referrer-when-downgrade"",
+        "rel="preload"",
+      ]
+    `)
+    script.remove()
+  })
 })