mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
d3d5090e0f
The inline design script carries a CSP sha256 computed at render time. On an onion request body_filter.lua rewrites the clearnet CDN base inside the whole head payload, the script's bytes stop matching their hash, and every role whose script held a CDN URL has its branding refused wherever script-src-elem has no 'unsafe-inline'. web-svc-logout and web-svc-html are on nearly every deployment, so this was not a corner case. The config now rides in the script tag's data-design attribute, which CSP does not hash and onionize may rewrite freely, and the first statement of the script reads it back into INFINITO_DESIGN. The executable body is identical on both vhosts, so one hash authorizes both. All 35 design scripts now read the config instead of interpolating design.urls. The 13 that still needed converting keep their render-time guards, so a role with branding disabled still emits no script at all, exactly as before. slots left the config object: no script has ever read it. A new check refuses a branding URL in a script body, so the class cannot return, and a unit test drives the config through to_json, Jinja's escape and an HTML parser with a hostile title to prove the attribute round trip. Not yet proven: that the hash matches on a real onion vhost. This stack runs without tor and every role deployed here has 'unsafe-inline', so the check needs a tor-enabled deploy of one of the seven roles that disable logout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>