I am feeling a bit puzzled about how JavaScript can incorporate external libraries.
JavaScript itself does not have the capability to load libraries on its own. This functionality is typically provided by the hosting environment, such as a browser or node.js.
Does JavaScript execute a GET request to the URL specified in the script tags? And where does the browser store this library - within the DOM?
When loading an external library, the browser will indeed make a GET request and load the script into the JavaScript environment, but only the HTMLScriptElement DOM Node representation will be retained in the DOM.
It appears that many actions performed by the browser when loading external libraries could potentially violate the same-origin policy.
The same-origin policy primarily aims to safeguard private data on third-party websites. Scripts themselves are not classified as data (though they may contain embedded data). JSON-P relies on this approach to work around the constraints of the same-origin policy.
Do modern browsers implement any additional security measures when fetching scripts from external sources?
No, there isn't any extra security reinforcement specifically for loading scripts from external sites.
Is it viable to load an external library and then display its source on the screen?
No, this is not feasible directly. However, one workaround could involve using XHR to perform a separate HTTP request to access the script source — although this method is still subject to the constraints imposed by the same-origin policy.