96f1d27221
dtf-site.html held commercial rules, the nesting engine, PDF analysis, the cart and every handler in a single inline script, 42% of the runtime code in one file, and the money logic lived in the middle of it. It is now nine files under local/static, cut at the section markers the original author left, so no function was split across a boundary: config, product modes, upload, sheet analysis, PDF, quality, packing, cart, flow. They load as classic scripts in the original order and share one global scope, so evaluation is exactly what it was; the extraction was checked byte-identical against the original before the tags replaced it. dtf-site.html is 1,394 lines of markup and style. With no inline script left anywhere, the policy no longer needs a hash allowlist: script-src is now 'self' alone, which is stronger than what it replaced and cannot drift as the page changes. Three things depended on the old shape and were updated rather than worked around. The pricing parity test read the ladder out of the HTML and now reads it from site-config.js, still proving the server agrees with what the customer is shown. The isolated artwork test served four hardcoded script paths and now serves any script that resolves inside local/static, so the next file added does not silently 404. The CSP assertion checked the whole policy for 'unsafe-inline' and now checks the script-src directive alone, since style-src legitimately carries it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
27 lines
1.3 KiB
Python
27 lines
1.3 KiB
Python
"""Compile the gateway configuration: hash any trusted inline script for the CSP.
|
|
|
|
The Site's behaviour now lives in separate files, so normally there is nothing to
|
|
hash and the policy is simply script-src 'self' — no allowlist to get wrong. The
|
|
hashing stays because an inline script added later must not silently need
|
|
'unsafe-inline'; it is hashed automatically instead.
|
|
"""
|
|
import base64
|
|
import hashlib
|
|
import os
|
|
from pathlib import Path
|
|
import re
|
|
|
|
root = Path('/build')
|
|
hashes = []
|
|
for html in [root / 'dtf-site.html', *(root / 'local/static').glob('*.html')]:
|
|
for attributes, script in re.findall(r'<script\b([^>]*)>(.*?)</script>', html.read_text(), re.S | re.I):
|
|
if not re.search(r'\bsrc\s*=', attributes, re.I) and script.strip():
|
|
hashes.append("'sha256-" + base64.b64encode(hashlib.sha256(script.encode()).digest()).decode() + "'")
|
|
|
|
template = Path(os.environ.get('NGINX_TEMPLATE', root / 'local/nginx.conf.template')).read_text()
|
|
rendered = template.replace('@SCRIPT_HASHES@', ' '.join(hashes))
|
|
# Collapse the gap an empty hash list leaves behind, so the policy reads cleanly.
|
|
rendered = re.sub(r"(script-src 'self')\s+;", r'\1;', rendered)
|
|
(root / 'default.conf.template').write_text(rendered)
|
|
print(f'CSP script-src: {len(hashes)} inline hash(es)')
|