merge: WebUI modernization stack (PR2-PR7, phases 2b-4)

Author: jkyberneees

.github/workflows/test.yml

@@ -48,6 +48,18 @@ jobs:
           version: v2.12.2
           args: --timeout=10m
 
+  ui-js:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: test
+        run: node --test "cmd/odek/ui/js/**/*.test.js"
+
   vuln:
     runs-on: ubuntu-latest
     steps:

cmd/odek/serve.go

@@ -1762,6 +1762,17 @@ func handleStatic(wsToken string) http.HandlerFunc {
 			return
 		}
 		entry, ok := staticFiles[r.URL.Path]
+		if !ok && strings.HasPrefix(r.URL.Path, "/js/") {
+			// ES modules under /js/ are served from the embedded ui/js
+			// directory. Sanitize to a flat .js file name so path traversal
+			// is impossible.
+			name := strings.TrimPrefix(r.URL.Path, "/js/")
+			if name != "" && !strings.Contains(name, "..") &&
+				!strings.ContainsAny(name, "/\\") && strings.HasSuffix(name, ".js") {
+				entry = [2]string{"ui/js/" + name, "application/javascript; charset=utf-8"}
+				ok = true
+			}
+		}
 		if !ok {
 			http.NotFound(w, r)
 			return
@@ -1809,7 +1820,10 @@ func handleStatic(wsToken string) http.HandlerFunc {
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("Referrer-Policy", "no-referrer")
 		w.Header().Set("X-Frame-Options", "DENY")
-		w.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
+		// Strict CSP: no inline scripts (all handlers are addEventListener /
+		// delegation), styles only from self + the few style="" attributes in
+		// index.html. frame-ancestors replaces the old standalone CSP line.
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' ws: wss:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'")
 		w.Write(data)
 	}
 }