From 9ed1e25a5668c693f6fe0d00f0694b4bebab0992 Mon Sep 17 00:00:00 2001 From: Leon Klingele Date: Mon, 17 Nov 2025 18:01:49 +0100 Subject: [PATCH 1/3] chore(api,docs): update unpkg libraries, specify SRI hash --- api.go | 9 ++------- docs/docs/features/api-docs.md | 14 +++++--------- 2 files changed, 7 insertions(+), 16 deletions(-) diff --git a/api.go b/api.go index e93c88fd..b1fcb9d9 100644 --- a/api.go +++ b/api.go @@ -488,20 +488,15 @@ func NewAPI(config Config, a Adapter) API { ` + title + ` - - - + + - - `)) }) diff --git a/docs/docs/features/api-docs.md b/docs/docs/features/api-docs.md index baca3402..2c77399d 100644 --- a/docs/docs/features/api-docs.md +++ b/docs/docs/features/api-docs.md @@ -38,17 +38,13 @@ router.Get("/docs", func(w http.ResponseWriter, r *http.Request) { Docs Example reference - - - + + @@ -84,7 +80,7 @@ router.Get("/docs", func(w http.ResponseWriter, r *http.Request) { - + `)) }) @@ -112,11 +108,11 @@ router.Get("/docs", func(w http.ResponseWriter, r *http.Request) { SwaggerUI - +
- + @@ -79,24 +80,24 @@ api := humachi.New(router, config) router.Get("/docs", func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") // Very strict CSP so we never expose any data to the outside world - w.Header().Set("Content-Security-Policy", - "default-src 'none';"+ - " base-uri 'none';"+ - " connect-src 'self';"+ - " form-action 'none';"+ - " frame-ancestors 'none';"+ - " sandbox allow-same-origin allow-scripts;"+ - " script-src 'unsafe-eval' https://unpkg.com/;"+ // TODO: Somehow drop 'unsafe-eval' - " style-src 'unsafe-inline' https://unpkg.com/;"+ // TODO: Somehow drop 'unsafe-inline' - " trusted-types 'none'") - w.Write([]byte(` - + csp := []string{ + "default-src 'none'", + "base-uri 'none'", + "connect-src 'self'", + "form-action 'none'", + "frame-ancestors 'none'", + "sandbox allow-same-origin allow-scripts", + "script-src 'unsafe-eval' https://unpkg.com/", // TODO: Somehow drop 'unsafe-eval' + "style-src 'unsafe-inline' https://unpkg.com/", // TODO: Somehow drop 'unsafe-inline' + } + w.Header().Set("Content-Security-Policy", strings.Join(csp, "; ")) + w.Write([]byte(` + - API Reference - + + + API Reference + + `)) }) ```