block7.js

const scriptElt //see above - result of the monkey patched createElement
// Backup the original setAttribute function
const originalSetAttribute = scriptElt.setAttribute.bind(scriptElt)

// Define getters / setters to ensure that the script type is properly set
Object.defineProperties(scriptElt, {
    'src': {
        get() {
            return scriptElt.getAttribute('src')
        },
        set(value) {
            if(needsToBeBlacklisted(value, scriptElt.type)) {
                originalSetAttribute('type', 'javascript/blocked')
            }
            originalSetAttribute('src', value)
            return true
        }
    },
    'type': {
        set(value) {
            const typeValue =
                needsToBeBlacklisted(scriptElt.src, scriptElt.type) ?
                    'javascript/blocked' :
                value
            originalSetAttribute('type', typeValue)
            return true
        }
    }
})

// Monkey patch the setAttribute function so that the setter is called instead.
// Otherwise, setAttribute('type', 'whatever') will bypass our custom descriptors!
scriptElt.setAttribute = function(name, value) {
    if(name === 'type' || name === 'src')
        scriptElt[name] = value
    else
        HTMLScriptElement.protytope.setAttribute.call(scriptElt, name, value)
}