fix: harden CSP policy and address PR review feedback

Author: clean6378-max-it

app.py

@@ -25,6 +25,8 @@
         "img-src 'self' data:",
         "connect-src 'self'",
         "font-src 'self'",
+        "object-src 'none'",
+        "form-action 'self'",
         "base-uri 'self'",
         "frame-ancestors 'none'",
     ]
@@ -102,7 +104,8 @@ def create_app(
 
     @app.after_request
     def set_security_headers(response):
-        response.headers.setdefault("Content-Security-Policy", CSP_POLICY)
+        # Always set — do not use setdefault; a blueprint must not weaken CSP.
+        response.headers["Content-Security-Policy"] = CSP_POLICY
         return response
 
     @app.route("/")

docs/architecture.md

@@ -125,6 +125,8 @@ No bundler step — modern browsers load modules directly. Frontend unit tests u
 | `img-src` | `'self'`, `data:` | Session images and data URLs |
 | `connect-src` | `'self'` | API `fetch` calls to same origin |
 | `font-src` | `'self'` | Local fonts only |
+| `object-src` | `'none'` | Block plugins / `<object>` embeds (no plugin use in this app) |
+| `form-action` | `'self'` | Restrict form submissions to same origin |
 | `base-uri` | `'self'` | Restrict `<base>` tag injection |
 | `frame-ancestors` | `'none'` | Prevent clickjacking via iframes |
 

static/js/app.js

@@ -3,8 +3,8 @@
 // Shared helpers live in shared/utils.js, shared/markdown.js, shared/theme.js.
 
 import { state } from './shared/state.js';
-import { toggleSidebar, closeSidebar, loadingBar } from './shared/utils.js';
-import { HLJS_THEME_SHEETS, applyHljsTheme, applyTheme, toggleTheme, setWorkspaceMode } from './shared/theme.js';
+import { toggleSidebar, closeSidebar } from './shared/utils.js';
+import { HLJS_THEME_SHEETS, applyTheme, toggleTheme } from './shared/theme.js';
 import { showProjects } from './projects.js';
 import { showWorkspace, loadSession } from './sessions.js';
 import { showSearchPage } from './search.js';

static/js/search.js

@@ -44,7 +44,7 @@ export function showSearchPage() {
         if (!project || !sessionId) return;
         window.location.hash = `#project/${encodeURIComponent(project)}/${encodeURIComponent(sessionId)}`;
     });
-    document.getElementById('search-input').focus();
+    document.getElementById('search-input')?.focus();
 }
 
 export async function doSearch() {

tests/test_api_integration.py

@@ -21,6 +21,12 @@ def test_root_sets_csp_header(client):
     assert resp.headers.get("Content-Security-Policy") == CSP_POLICY
 
 
+def test_api_routes_set_csp_header(client):
+    resp = client.get("/api/projects")
+    assert resp.status_code == 200
+    assert resp.headers.get("Content-Security-Policy") == CSP_POLICY
+
+
 # --- /api/projects ---
 
 

tests/test_hljs_theme_consistency.py

@@ -19,7 +19,7 @@
 HLJS_THEME_INIT_JS = REPO_ROOT / "static" / "js" / "hljs-theme-init.js"
 # HLJS_THEME_SHEETS was extracted to shared/theme.js (Day 4 module split).
 # app.js re-exports it, but the canonical source is theme.js.
-APP_JS = REPO_ROOT / "static" / "js" / "shared" / "theme.js"
+THEME_JS = REPO_ROOT / "static" / "js" / "shared" / "theme.js"
 
 
 def _link_attr(html: str, link_id: str, attr: str) -> str:
@@ -38,7 +38,7 @@ def _link_attr(html: str, link_id: str, attr: str) -> str:
 def _js_theme_entry(js: str, theme: str) -> dict:
     """Return {'href': ..., 'integrity': ...} from HLJS_THEME_SHEETS.<theme>."""
     block = re.search(re.escape(theme) + r"\s*:\s*\{([^}]*)\}", js, re.DOTALL)
-    assert block, f"HLJS_THEME_SHEETS.{theme} entry not found in app.js"
+    assert block, f"HLJS_THEME_SHEETS.{theme} entry not found in theme.js"
     body = block.group(1)
     out = {}
     for key in ("href", "integrity"):
@@ -63,27 +63,27 @@ def _js_string_assignments(js: str, keys: tuple[str, ...]) -> dict[str, str]:
 
 def test_dark_theme_url_and_hash_match_between_html_and_js():
     html = INDEX_HTML.read_text(encoding="utf-8")
-    js = APP_JS.read_text(encoding="utf-8")
+    js = THEME_JS.read_text(encoding="utf-8")
 
     html_href = _link_attr(html, "hljs-theme", "href")
     html_integrity = _link_attr(html, "hljs-theme", "integrity")
     js_dark = _js_theme_entry(js, "dark")
 
     assert html_href == js_dark["href"], (
-        "highlight.js theme URL drifted between index.html and app.js — "
-        f"html={html_href!r}, app.js HLJS_THEME_SHEETS.dark={js_dark['href']!r}. "
+        "highlight.js theme URL drifted between index.html and theme.js — "
+        f"html={html_href!r}, theme.js HLJS_THEME_SHEETS.dark={js_dark['href']!r}. "
         "On a version bump both must update together (issue #19)."
     )
     assert html_integrity == js_dark["integrity"], (
-        "highlight.js theme SRI hash drifted between index.html and app.js — "
+        "highlight.js theme SRI hash drifted between index.html and theme.js — "
         f"html={html_integrity!r}, "
-        f"app.js HLJS_THEME_SHEETS.dark={js_dark['integrity']!r}."
+        f"theme.js HLJS_THEME_SHEETS.dark={js_dark['integrity']!r}."
     )
 
 
 def test_light_theme_url_and_hash_match_between_hljs_init_and_theme_js():
     init_js = HLJS_THEME_INIT_JS.read_text(encoding="utf-8")
-    theme_js = APP_JS.read_text(encoding="utf-8")
+    theme_js = THEME_JS.read_text(encoding="utf-8")
 
     init = _js_string_assignments(init_js, ("integrity", "href"))
     js_light = _js_theme_entry(theme_js, "light")