Serve diff2html from the proxy instead of jsDelivr

internal/server/server_test.go

@@ -761,6 +761,8 @@ func TestStaticFiles(t *testing.T) {
 	}{
 		{"/ui/static/vendor/tailwind.js", []string{"text/javascript", "application/javascript"}},
 		{"/ui/static/vendor/lucide.min.js", []string{"text/javascript", "application/javascript"}},
+		{"/ui/static/vendor/diff2html-ui.min.js", []string{"text/javascript", "application/javascript"}},
+		{"/ui/static/vendor/diff2html.min.css", []string{"text/css"}},
 		{"/ui/static/style.css", []string{"text/css"}},
 	}
 

internal/server/templates/pages/compare_versions.html

@@ -66,10 +66,10 @@ <h2 class="text-lg font-semibold">Changes</h2>
 </div>
 
 <!-- diff2html CSS -->
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/diff2html/bundles/css/diff2html.min.css" />
+<link rel="stylesheet" href="/ui/static/vendor/diff2html.min.css" />
 
 <!-- diff2html JS -->
-<script src="https://cdn.jsdelivr.net/npm/diff2html/bundles/js/diff2html-ui.min.js"></script>
+<script src="/ui/static/vendor/diff2html-ui.min.js"></script>
 
 <script>
 const ecosystem = '{{.Ecosystem}}';

internal/server/templates_test.go

@@ -2,8 +2,10 @@ package server
 
 import (
 	"database/sql"
+	"io/fs"
 	"net/http"
 	"net/http/httptest"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -709,3 +711,28 @@ func BenchmarkFirstRender(b *testing.B) {
 		}
 	}
 }
+
+// thirdPartyAsset matches a script or stylesheet loaded from another origin.
+var thirdPartyAsset = regexp.MustCompile(`<(?:script[^>]*\ssrc|link[^>]*\shref)="(?:https?:)?//[^"]*"`)
+
+// Pages run on the proxy origin, so a script or stylesheet from elsewhere
+// would run with the proxy's privileges and break offline deployments.
+// Vendor it under static/vendor instead.
+func TestTemplatesLoadNoThirdPartyAssets(t *testing.T) {
+	err := fs.WalkDir(templatesFS, "templates", func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+		content, err := templatesFS.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		for _, match := range thirdPartyAsset.FindAllString(string(content), -1) {
+			t.Errorf("%s loads a third-party asset: %s", path, match)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}