From 21aa9b373c8a473eb6b55c671de42a54b4cd71af Mon Sep 17 00:00:00 2001
From: martin veillette <martin.veillette@gmail.com>
Date: Wed, 12 Aug 2026 14:06:38 -0400
Subject: [PATCH] fix: add codemirror sri and escape error overlay html

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 dev-utils.js                  |  2 +-
 examples/code-playground.html | 46 +++++++++++++++++++++++++++++------
 2 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/dev-utils.js b/dev-utils.js
index 027c861..e597048 100644
--- a/dev-utils.js
+++ b/dev-utils.js
@@ -212,7 +212,7 @@ export class ErrorOverlay {
 
         <div style="background: #1a1f3a; padding: 20px; border-radius: 8px; margin-bottom: 20px; border-left: 4px solid #ef4444;">
           <div style="color: #ef4444; font-weight: bold; margin-bottom: 10px;">
-            ${error.name || 'Error'}
+            ${this.escapeHtml(error.name || 'Error')}
           </div>
           <div style="color: #eee; font-size: 16px; margin-bottom: 15px;">
             ${this.escapeHtml(error.message)}
diff --git a/examples/code-playground.html b/examples/code-playground.html
index e725a91..558ea45 100644
--- a/examples/code-playground.html
+++ b/examples/code-playground.html
@@ -327,20 +327,50 @@ <h1>🎮 Live Code Playground</h1>
       </div>
     </div>
 
-    <!-- CodeMirror JS -->
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/codemirror.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/mode/javascript/javascript.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/closebrackets.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/matchbrackets.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/show-hint.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/javascript-hint.min.js"></script>
+    <!-- CodeMirror JS (SRI: cdnjs CodeMirror 5.65.20) -->
+    <script
+      src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/codemirror.min.js"
+      integrity="sha512-hJEMjfR4ds7mXbBot3i/R+CsiyYpeWSezXul8uLBT8wXAHPUdhRgl4LLTtMGwjarftGKiQqK1v20XScm0ANTPQ=="
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    ></script>
+    <script
+      src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/mode/javascript/javascript.min.js"
+      integrity="sha512-Cbz+kvn+l5pi5HfXsEB/FYgZVKjGIhOgYNBwj4W2IHP2y8r3AdyDCQRnEUqIQ+6aJjygKPTyaNT2eIihaykJlw=="
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    ></script>
+    <script
+      src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/closebrackets.min.js"
+      integrity="sha512-tsjcYO5hFvViRssxiM7Jhd8601epWOx1He3Hl4yuI5dKKPxr43KxkOhc9GZeeqzlYJm9ABb7UPA9697NiqZZ7Q=="
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    ></script>
+    <script
+      src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/edit/matchbrackets.min.js"
+      integrity="sha512-GSYCbN/le5gNmfAWVEjg1tKnOH7ilK6xCLgA7c48IReoIR2g2vldxTM6kZlN6o3VtWIe6fHu/qhwxIt11J8EBA=="
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    ></script>
+    <script
+      src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/show-hint.min.js"
+      integrity="sha512-+Vu6KfeJ+ak4ipbxtjUR3b1M/yklDlglRB/03ZsMzu1E/FQ+AL7D88THTyigWmh0xqXnP7pV9myEqac9C2N+2A=="
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    ></script>
+    <script
+      src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.20/addon/hint/javascript-hint.min.js"
+      integrity="sha512-omIxBxPdObb7b3giwJtPBiB86Mey/ds7qyKFcRiaLQgDxoSR+UgCYEFO7jRZzPOCZAICabGCraEhOSa71U1zFA=="
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    ></script>
 
     <script type="module">
       import CD48 from '../cd48.js';
       import { setupDevMode } from '../dev-utils.js';
 
       // Setup dev mode
-      const { logger } = setupDevMode({
+      setupDevMode({
         logger: { enabled: true, level: 'debug' },
         showOverlay: true,
       });