sec(frontend/docs): SRI + version pin on Go-served swagger-ui (closes #541, #543) - #573
Conversation
The Go /docs handler still loaded swagger-ui-dist@5.32.5 from unpkg with no integrity/crossorigin, leaving the public docs page open to CDN poisoning (issue #447). PR #521 only fixed the static frontend/src/docs.html, not the Go handler (issue #541). Bring handler_docs.go to parity with docs.html: pin @5.32.6, add the same sha384 SRI hashes + crossorigin="anonymous" to the css/bundle/standalone- preset tags, and load the standalone-preset script the bootstrap references (previously missing). The unpkg host stays in script-src because element-level SRI does not grant CSP load permission; the godoc explains why. Add a Go regression test asserting the served HTML keeps the version pin and SRI attrs and uses the shared hash constants. Closes #447, #541 Refs #521
PR #521 pinned the swagger-ui-dist version and added SRI integrity/crossorigin to docs.html but added no test, so a future edit could silently drop the integrity attribute or revert the @5.32.6 pin to a floating @5 tag (issue #543). Add a regression test that, for each unpkg/swagger-ui-dist link/script tag in docs.html, asserts an exact x.y.z version (never a floating major tag), an integrity="sha384-..." attribute, and crossorigin="anonymous". Closes #543 Refs #447, #521
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Summary
Brings the Go-served swagger-ui docs page to parity with the
docs.htmlhardening from PR #521, closing the remaining half of #447 plus its regression test.Fixes
internal/api/handler_docs.go: pins swagger-ui to the same version asdocs.html, adds the matchingintegritySRI hashes +crossorigin="anonymous"to the CDN script/link tags, and tightensdocsPageCSPsoscript-srcno longer allowshttps://unpkg.comwithout a hash constraint. This is the actual sec(frontend): /api/docs CDN scripts loaded from unpkg.com without Subresource Integrity (SRI) #447 work (PR sec(frontend/docs): pin swagger-ui version + add SRI hashes (closes #447, #418) #521 only toucheddocs.html).frontend/src/__tests__/docs.test.ts+internal/api/handler_docs_test.go) asserting both surfaces keep the version pin and the SRIintegrityattribute, so a future edit cannot silently drop them.Version + SRI hashes are kept consistent with PR #521's
docs.htmlvalues.Test plan
internal/api/handler_docs_test.goasserts the served HTML contains the pinned version +integrity+crossoriginfrontend/src/__tests__/docs.test.tsguards the docs.html tagsCloses #541, #543. Refs #447.