extract dashboard assets into embed.FS and tighten CSP#15
Merged
Conversation
akarnani
force-pushed
the
helm-readonly-rootfs
branch
from
365f0a1 to
c86e358
Compare
The dashboard was a single 740-line Go file with HTML, CSS, and JS
glued into a const string and inline onclick= attributes throughout.
Strict CSP (no 'unsafe-inline') was unreachable in that shape, and the
embedded source was hostile to read and edit.
Move the assets into proper files under webapp/templates/ and
webapp/static/, embed them via go:embed, and parse the template once
at package init via ParseFS. Static assets are served by
http.FileServer over the embedded fs, mounted at /static/. Single
static binary unchanged, still works with readOnlyRootFilesystem.
Replace every inline onclick= with delegated event listeners keyed on
data-action attributes. The form's onsubmit="return false" becomes a
submit listener calling preventDefault.
Add a Content-Security-Policy header to the securityHeaders middleware:
default-src 'self'; script-src 'self'; style-src 'self'; object-src
'none'; frame-ancestors 'none'; base-uri 'none'. No inline script,
no eval, no third-party origins.
Verified end-to-end: dashboard renders, /static/dashboard.{js,css}
serve with correct MIME types, CSP header present on all responses
(including /metrics on the separate port), all hardening headers
flowing.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
akarnani
force-pushed
the
webapp-csp-embed
branch
from
2641eb6 to
d0c954e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on top of #14.
Summary
webapp/webapp.goconst string into proper files underwebapp/templates/andwebapp/static/, embedded via `go:embed`. Single static binary unchanged.Test plan
🤖 Generated with Claude Code