[D9] Javascript Editor

Thank you for applying!
Remember to change status, when the project is ready for review, as in this queue Active means Don't review yet the project I am using for this application.

@marco.aresu Please add the advantage of using this module over other modules that provide similar functionality. eg: Asset Injector

Thanks for you contribution!

manual review:

1. js_editor_form_system_theme_settings_alter(): You are allowing an admin user to inject arbitrary Javascript into a Drupal site. They could store an XSS attack in the Javascript there, so you need to protect this action with a permission where the admin can already compromise the site. In Drupal we do this with the "restrict access" option on a permission. As far as I can see the theme settings form is only protected with the "administer themes" permission which does not have that restrict option set. It is probably best if you create your own permission like "execute arbitrary js_editor scripts" and enforce that with the #access property in your additional form elements. This is currently a security blocker.
2. JsEditorThemeNegotiator: the class doc block repeat the class name in the second sentence, I think that line can be removed?
3. JsEditorThemeNegotiator: why do you need this class? You are not changing the active theme in any way, so it could be removed?
4. config schema is missing for config object, see https://www.drupal.org/docs/8/api/configuration-api/configuration-schema...

I changed the issue priority as described on Review process for security advisory coverage: What to expect / Application Review Timelines.

To reviewers: Please change back the priority to Normal after reviewing the project.

The points reported in #8 have been fixed.

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.