Release v1.1.14

[ormidales]

This pull request introduces major improvements to security policies and resource validation throughout the project, focusing on stricter Content Security Policy (CSP) enforcement for all HTML pages and enhanced URI and cache key validation in core loader and shader modules. These changes help prevent common web vulnerabilities, tighten resource access, and ensure robust handling of external inputs.

Security policy enhancements:

• All public HTML pages (index.html, demos.html, gallery.html, demo.html) now use a strict CSP meta tag, removing bare 'self' from script-src and replacing it with 'none' for pages without scripts, and a hash-based policy plus 'strict-dynamic' for demo.html to only allow the known bootstrap import. This prevents unauthorized script execution and mitigates XSS risks. [1] [2] [3] [4] [5]
• A new SECURITY.md file documents the CSP approach, rationale, and procedures for reporting vulnerabilities, providing clear guidance for maintainers and contributors.
• Additional tests in csp.test.ts verify that no page uses a bare 'self' in script-src without a nonce or hash, and that the hash in demo.html matches the actual inline script content. [1] [2]

Resource validation improvements:

• The glTF loader (src/core/GltfLoader.ts) now enforces a maximum URI length and performs bounded, full percent-decoding of external buffer URIs, validating both the original and decoded forms to prevent path traversal and SSRF vulnerabilities. The loader also checks the decoded JSON string's heap footprint before parsing, guarding against resource exhaustion. [1] [2] [3] [4] [5] [6]
• The shader cache (src/core/ShaderCache.ts) introduces a maximum key length for explicit cache keys and uses compact FNV-1a hashes for auto-generated keys, ensuring predictable, bounded cache key sizes and preventing accidental resource exhaustion or collisions. [1] [2] [3] [4] [5] [6]

[Copilot]

Pull request overview

Release v1.1.14 focuses on tightening security controls at the HTML entrypoints (CSP hardening) and strengthening input/resource validation in core subsystems (glTF loading + shader/program caching).

Changes:

• Hardened CSP across public HTML pages (no bare script-src 'self'; hash + strict-dynamic bootstrap for demo.html).
• Strengthened core validation: bounded JSON parsing guardrails in GltfLoader and bounded explicit cache key sizes + hash-based shader keys in ShaderCache.
• Added/updated tests and documentation to enforce CSP invariants and validate new loader/cache behaviors.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
index.html	CSP updated to script-src 'none' for a no-script page.
demos.html	CSP updated to script-src 'none' for a no-script page.
gallery.html	CSP updated to script-src 'none' for a no-script page.
demo.html	CSP switched to hash + strict-dynamic; bootstraps via inline module import.
SECURITY.md	Documents CSP approach, rationale, and reporting guidance.
tests/csp.test.ts	Adds checks preventing bare script-src 'self' and validates demo.html hash freshness.
src/core/GltfLoader.ts	Adds decoded-string size guard; adds strict URI max length; adds bounded full percent-decoding + dual-form URI validation before resolveUri.
tests/gltf.test.ts	Adds regression tests for decoded-string guard and strict URI length/decoding behavior; updates payload limit expectation.
src/core/ShaderCache.ts	Introduces MAX_KEY_LENGTH for explicit keys; defaults shader keys to hash-derived strings instead of raw source.
tests/shader.test.ts	Adds tests for hashed default shader keys and explicit key length validation.
package.json	Bumps version to 1.1.14.
package-lock.json	Bumps lockfile package version to 1.1.14.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ormidales]

@copilot open a new pull request to apply changes based on the comments in this thread

[Copilot]

@ormidales I've opened a new pull request, #359, to work on those changes. Once the pull request is ready, I'll request review from you.