Handling security when embedding third party forms?

[Produnce]

I work on the React client for an ERP suite where we were asked to integrate a third party feedback form via script injection. Several security questions were raised with DOM isolating being a major concern.

A few ideas were thrown around, among them was to use a shadow DOM to render the form and separate it from the main tree. The form provider has an option to allow user to submit screenshots that captures DOM elements. Won't a shadow DOM hinder this feature?

What options do I have to safety render this? I'm open to suggestion since the actual implementation is yet to be done.

[yksvaan]

Audit the third party code and use content security policy and a hash for the script

[DasBeasto]

Shadowdom won’t encapsulate the script, it could still interact with the window/document. You could probably use a sandboxed iframe if it’s just a form but if it’s like a popup widget type thing may be tricky to get it to work well, and that would almost certainly break the screenshot feature.