feat(security): CSP stricte + durcissement (E10-5, #166) - #174
Merged
Conversation
) CSP stricte SANS 'unsafe-inline', active via <meta http-equiv> et vérifiée en CI. Débloquée par l'extraction des styles inline (#163). - index.html : script de pré-peinture du thème externalisé (src/theme-init.js), bloc <style> déplacé dans main.css, attribut style="" du bouton langue → classe (.theme-toggle--lang). Plus aucun inline → script-src/style-src 'self'. - CSP : default-src 'self' ; object-src 'none' ; frame-ancestors 'none' ; base-uri/form-action 'self' ; img-src 'self' data: (favicon). Seule exception documentée : Google Fonts (style-src/font-src scopés à ces 2 domaines). - <meta name="referrer" content="no-referrer">. - Harnais : nouveau check checkCSP (écoute securitypolicyviolation sur carte + salle → échoue à la moindre violation) ; normalisation du rendu via feuille construite (adoptedStyleSheets, CSP-safe) au lieu d'un <style> injecté ; bypass CSP ciblé pour l'injection d'axe (outil de test). - docs/SECURITY.md : CSP, exception fonts, en-têtes serveur/CDN recommandés. Les 9 écrans rendus CSP active à 0,00 % (sources ET dist/). 655 tests, lint vert. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This was referenced Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ferme #166 (et clôt l'EPIC 10). CSP stricte sans
'unsafe-inline', active via<meta http-equiv>et vérifiée en CI. Débloquée par #163 (extraction des styles inline).index.html — plus aucun inline
src/theme-init.js(script-src 'self').<style>déplacé dansmain.css; attributstyle=""du bouton langue → classe.theme-toggle--lang(style-src 'self').La politique
<meta name="referrer" content="no-referrer">. Seule exception : Google Fonts, scopée à ses 2 domaines et documentée (self-host = dépasser le budget 280 KB).Vérification en CI
Nouveau check
checkCSP: écoutesecuritypolicyviolationsur la carte + une salle → échoue à la moindre violation (testé négativement : unstyle=""injecté est bien capté). Les 9 écrans sont rendus CSP active à 0,00 % (sources etdist/). Le harnais normalise le rendu via feuille construite (adoptedStyleSheets, CSP-safe) ; l'injection d'axe utilise un bypass CSP ciblé (outil de test).Doc
docs/SECURITY.md: CSP, exception fonts, en-têtes serveur/CDN à poser hors<meta>(X-Content-Type-Options,Permissions-Policy…).655 tests · lint vert · CSP + a11y + 9 écrans conformes.