rbrooks/WeatherBot

Watch

Fork 0

Vendor htmx/Leaflet locally (or add SRI) — all pages execute unpkg-served JS #59

New issue

Closed

opened 2026-07-18 05:31:23 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-18 05:31:23 +00:00

Contributor

base.html:10-15 and public_location.html:8-9 load htmx 2.0.3, htmx-ext-sse
2.2.2, and Leaflet 1.9.4 from unpkg with no integrity attributes. Vendor
the pinned files under static/vendor/ and reference locally (preferred for
a self-hosted app: removes third-party script trust and the availability
dependency), or at minimum add SRI hashes + crossorigin="anonymous".
Renovate note: vendored files won't be version-managed — add a comment
documenting versions, or keep CDN+SRI if Renovate management matters more.

Acceptance criteria:

No page loads executable JS/CSS from third-party origins (or SRI on all)
UI functions with no internet egress from the browser's perspective

Filed from the 2026-07-17 codebase audit (docs/.internal/report-2026-07-17.md), finding F-20.

base.html:10-15 and public_location.html:8-9 load htmx 2.0.3, htmx-ext-sse 2.2.2, and Leaflet 1.9.4 from unpkg with no `integrity` attributes. Vendor the pinned files under `static/vendor/` and reference locally (preferred for a self-hosted app: removes third-party script trust and the availability dependency), or at minimum add SRI hashes + `crossorigin="anonymous"`. Renovate note: vendored files won't be version-managed — add a comment documenting versions, or keep CDN+SRI if Renovate management matters more. **Acceptance criteria:** - [ ] No page loads executable JS/CSS from third-party origins (or SRI on all) - [ ] UI functions with no internet egress from the browser's perspective --- _Filed from the 2026-07-17 codebase audit (`docs/.internal/report-2026-07-17.md`), finding F-20._

claude-bot added this to the v1.0.3 - Security hardening milestone

2026-07-18 05:31:23 +00:00

claude-bot added the

type:security

type:maintenance

labels

2026-07-18 05:31:23 +00:00

rbrooks referenced this issue from a commit

2026-07-18 07:24:46 +00:00

Vendor frontend assets locally; harden public page; POST logout

claude-bot referenced this issue

2026-07-18 07:25:01 +00:00

v1.0.3 — Security hardening #93

claude-bot commented

2026-07-18 07:29:52 +00:00

Author

Contributor

Fixed in #93 (merged to main). htmx 2.0.3, htmx-ext-sse 2.2.2, and Leaflet 1.9.4 (JS + CSS + marker/layer images) are now vendored under static/vendor/ and referenced locally from base.html and public_location.html; no page loads executable JS/CSS from unpkg anymore. Pinned versions are documented in an HTML comment next to the references (vendored files aren't Renovate-managed). Note: assets live under the repo-root static/ dir, which is the actual StaticFiles mount.

Fixed in #93 (merged to `main`). htmx 2.0.3, htmx-ext-sse 2.2.2, and Leaflet 1.9.4 (JS + CSS + marker/layer images) are now vendored under `static/vendor/` and referenced locally from `base.html` and `public_location.html`; no page loads executable JS/CSS from unpkg anymore. Pinned versions are documented in an HTML comment next to the references (vendored files aren't Renovate-managed). Note: assets live under the repo-root `static/` dir, which is the actual `StaticFiles` mount.

claude-bot closed this issue

2026-07-18 07:31:04 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/WeatherBot#59

No description provided.

Rows
Columns