From fba8ae999f0e4cf15391dcdbea9a933b5f346bd7 Mon Sep 17 00:00:00 2001 From: PARTH ROHIT Date: Sun, 6 Sep 2026 03:24:13 +0100 Subject: [PATCH 1/5] fix(website): adapt security hardening to current Astro site Signed-off-by: parthrohit22 --- website/scripts/verify-site.mjs | 9 +++++++++ website/src/layouts/Base.astro | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/website/scripts/verify-site.mjs b/website/scripts/verify-site.mjs index 4502e53..142c971 100644 --- a/website/scripts/verify-site.mjs +++ b/website/scripts/verify-site.mjs @@ -33,6 +33,15 @@ for (const file of htmlFiles) { if (!html.includes('href="#main-content"')) failures.push(`${relative} has no skip link`); if (!html.includes(' directive.trim().startsWith('script-src')) || ''; + if (!scriptPolicy || scriptPolicy.includes('unsafe-inline')) { + failures.push(`${relative} allows inline script execution in its Content-Security-Policy`); + } + for (const directive of ['object-src \'none\'', 'base-uri \'self\'', 'form-action \'self\'', 'frame-ancestors \'self\'']) { + if (!csp.includes(directive)) failures.push(`${relative} is missing CSP directive ${directive}`); + } for (const match of html.matchAll(/href="([^"]+)"/g)) { const href = match[1]; if (!href.startsWith('/openshield/')) continue; diff --git a/website/src/layouts/Base.astro b/website/src/layouts/Base.astro index 43bc8ac..afe4dd1 100644 --- a/website/src/layouts/Base.astro +++ b/website/src/layouts/Base.astro @@ -102,7 +102,7 @@ const siteJsonLd = { directives browsers support in document metadata. Hosting-level directives must be added if the deployment moves to a configurable edge. --> - + From 3416bd47f7fd1de7290d8c7c4c08375ea9cfaa6e Mon Sep 17 00:00:00 2001 From: parthrohit22 Date: Tue, 8 Sep 2026 18:09:34 +0100 Subject: [PATCH 2/5] fix(website): drop meta-ignored frame-ancestors, force external scripts TFT444 / m-khan-97 review: frame-ancestors 'self' in a CSP is silently ignored by browsers (only an HTTP response header enforces it), and GitHub Pages cannot set that header. verify-site.mjs required the directive, so CI reported clickjacking protection that does not exist. - Base.astro: remove frame-ancestors from the meta CSP; expand the comment to state which directives a meta policy cannot enforce and that clickjacking protection needs a real header at a configurable edge. - verify-site.mjs: stop requiring frame-ancestors; document why. Also addresses m-khan-97's 'verify the built site so tightening script-src does not break its actual scripts': the Astro build was inlining 19 hoisted } - + From 339f678274c33cda1f9ea39e735fd457fede3dc9 Mon Sep 17 00:00:00 2001 From: parthrohit22 Date: Tue, 8 Sep 2026 18:14:56 +0100 Subject: [PATCH 3/5] fix(website): reword verify-site inline-script message to clear Semgrep The literal ''). The check is a build-output linter, not a security sanitizer, but the finding is fair. Replaced with a plain case-insensitive index walk from each opening tag to its close - same three outcomes (external src -> ok, json/ld+json data -> ok, non-empty inline body -> fail), no tag regex. Signed-off-by: parthrohit22 --- website/scripts/verify-site.mjs | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/website/scripts/verify-site.mjs b/website/scripts/verify-site.mjs index 7e4b3c6..c6ee1a3 100644 --- a/website/scripts/verify-site.mjs +++ b/website/scripts/verify-site.mjs @@ -40,20 +40,30 @@ for (const file of htmlFiles) { failures.push(`${relative} allows inline script execution in its Content-Security-Policy`); } // script-src 'self' with no 'unsafe-inline'/nonce/hash means the browser - // silently blocks any inline