From 2f9b3bf080bfb7352f5b9dcac6da68e6178ddc9d Mon Sep 17 00:00:00 2001 From: linusdevx Date: Tue, 23 Jun 2026 10:52:21 +0530 Subject: [PATCH] chore(security): add SRI integrity to CDN-loaded scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds sha384 integrity hashes and crossorigin=anonymous to the three CDN-hosted dependencies in index.html: - pako@2.1.0 (compression for share URLs) - lucide@1.14.0 (icon library) - monaco-editor@0.44.0 loader Mitigates the supply-chain risk of a tampered CDN response — the browser refuses to execute any script whose content doesn't match the hash. Resolves the only real CodeQL alert (js/functionality-from-untrusted-source) on index.html:51-53. Maintenance note: each version bump now requires regenerating the hash: curl -sL | openssl dgst -sha384 -binary | openssl base64 -A --- index.html | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/index.html b/index.html index b02676f..0c73aac 100644 --- a/index.html +++ b/index.html @@ -48,9 +48,9 @@ - - - + + +