Const
The loop evaluates whatever the server hands it, so the server must be one only a local process can be. origin is caller-supplied and reaches fetch directly; a remote CORS-enabled host would otherwise be able to drive eval in the page.
origin
fetch
eval
The loop evaluates whatever the server hands it, so the server must be one only a local process can be.
originis caller-supplied and reachesfetchdirectly; a remote CORS-enabled host would otherwise be able to driveevalin the page.