fix: strip inline event handlers from sub-app HTML - #106
Merged
Merged
Conversation
script-src 'self' blocks onclick="…" exactly like an inline <script>, so a handler that survives the build is dead in production. Where no CSP is served (astro dev/preview) it runs, and the docs-example fixture's theme toggle re-added `dark` there. transformSubAppHtml() now drops every on* attribute; the element stays. build-integrity asserts no on* attribute anywhere in dist/ (walked as a parsed tree, so prose is not flagged) and that the fixture's toggle lost its handler. HEADLESS_RULES.md gains a "scripts as files" section. Closes #67 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #67.
script-src 'self'blocksonclick="…"exactly like an inline<script>, so anon*handler that survives the build is dead in production — and live underastro dev/preview, where the docs-example fixture's theme toggle re-addeddarkto a light-only knowledge base.Of the two policies in the issue this takes strip: it is what production already does, made true everywhere. Hoisting handlers into listener files needs a stable element handle per attribute and preserves behaviour nobody should depend on — the checker already warns (
KB-HTML-005).Changes
transformSubAppHtml()drops everyon*attribute (template content included); the element and its other attributes stay.build-integrity.spec.js: noon*attribute anywhere indist/, walked with parse5 so a handler quoted in prose is not flagged; the fixture's#theme-toggleis present without its handler (proves the strip ran on a real one).transform.spec.js: stripping across head/body/template, bareonuntouched, prose untouched.contract/HEADLESS_RULES.md: new "Required: scripts as files" section + checklist item;RULES.mdKB-HTML-005 says the handler is stripped.The vendored fixture keeps its toggle: it is now the evidence that stripping works.
Verification
npm test: 402 passed.🤖 Generated with Claude Code