Mehboob Khan
11a709744e
Some checks failed
CI / build (push) Has been cancelled
F-03: the legacy markup's 77 onclick="" attributes were the reason script-src still needed 'unsafe-inline', which let injected inline script/handlers run right past the policy. Migrated them to data-page/data-action markers handled by a single delegated click listener in siteController.js, dropped 'unsafe-inline' from script-src, and switched both server/index.mjs and vercel.json from Content-Security-Policy-Report-Only to enforcing. style-src keeps 'unsafe-inline' — that governs inline style="" attributes used throughout, a separate CSS-injection concern out of scope here. Verified against the built site with a real headless-Chromium run: nav, company dropdown, mobile menu, the demo modal (open/close/overlay-click/ inner-click), the modal's contact-page link, and the scroll-hint all still work, with zero console errors. F-10: confirmed via npm audit fix --dry-run that no non-breaking update remains (vite and react-router-dom both need a major bump, left deferred). Added npm audit to CI — full report for visibility, gated on critical only so it doesn't block on the already-tracked moderate/high advisories. F-11: uploaded PDFs now serve with Content-Disposition: attachment instead of rendering inline from the site's own origin. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
19 lines
1.1 KiB
JSON
19 lines
1.1 KiB
JSON
{
|
|
"rewrites": [
|
|
{ "source": "/((?!assets/|content/|logo.svg|robots.txt|sitemap.xml).*)", "destination": "/index.html" }
|
|
],
|
|
"headers": [
|
|
{
|
|
"source": "/(.*)",
|
|
"headers": [
|
|
{ "key": "X-Content-Type-Options", "value": "nosniff" },
|
|
{ "key": "X-Frame-Options", "value": "SAMEORIGIN" },
|
|
{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
|
|
{ "key": "Permissions-Policy", "value": "geolocation=(), camera=(), microphone=()" },
|
|
{ "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" },
|
|
{ "key": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self' https://*.hubspot.com https://*.hs-scripts.com https://*.hsforms.net https://*.usemessages.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; media-src 'self'; connect-src 'self' https://*.hubspot.com https://*.hsforms.com https://*.hs-analytics.net; frame-src https://*.hubspot.com https://*.hsforms.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" }
|
|
]
|
|
}
|
|
]
|
|
}
|