When someone requests that URL the bad-stuff.js will execute.
We can prevent our app from loading JS from bad-guy.example.com using CSP. If we have the following policy:
script-src: 'self'-
Now becuase we specified 'self' in the script-src directive we can only load JS from the same origin as our app, the request to load a script from bad-guy.example.com will be blocked by CSP!
Now because we specified 'self' in the script-src directive we can only load JS from the same origin as our app, the request to load a script from bad-guy.example.com will be blocked by CSP!
CSP will also prevent inline scripts from loading, so if you have some legit JavaScript on your site, like this:
<script> doSomething();