From 2400cc2ea109edef45be4c23b72865742a34983a Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Fri, 11 Sep 2026 23:22:11 +0200
Subject: [PATCH] fix(csp): ship the interface strings as a JSON data block,
 not an inline script

base.html.j2 set window.I18N from an executable inline <script>. A host
CSP can only allow an inline script by hash or by 'unsafe-inline', and this
script's content changes with every language, so no hash can cover it.
Infinito.Nexus serves the dashboard with a hash-based script-src-elem
whenever its logout feature is off, and there the script was blocked:
every page logged "Executing inline script violates the following Content
Security Policy directive 'script-src-elem ...'" and window.I18N stayed
undefined.

The strings now ship as <script id="i18n" type="application/json">, which
the browser does not execute and CSP does not govern; modal.js parses the
block before its first use. tojson escapes <, > and &, so a string that
contains "</script>" cannot end the block early.

Integration tests require that a page ships no executable inline script
and that a catalogue string containing "</script>" survives the round trip
through the block.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 app/static/js/modal.js               |  3 +++
 app/templates/moduls/base.html.j2    |  2 +-
 tests/integration/test_app_routes.py | 32 ++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/app/static/js/modal.js b/app/static/js/modal.js
index 470071a..013d143 100644
--- a/app/static/js/modal.js
+++ b/app/static/js/modal.js
@@ -1,3 +1,6 @@
+const i18nBlock = document.getElementById('i18n');
+window.I18N = i18nBlock ? JSON.parse(i18nBlock.textContent) : {};
+
 function t(source) {
   return (window.I18N || {})[source] || source;
 }
diff --git a/app/templates/moduls/base.html.j2 b/app/templates/moduls/base.html.j2
index 4955545..2712fa1 100644
--- a/app/templates/moduls/base.html.j2
+++ b/app/templates/moduls/base.html.j2
@@ -71,7 +71,7 @@
         </div>
         <!-- Include modal -->
         {% include "moduls/modal.html.j2" %}
-        <script>window.I18N = {{ ui_strings | tojson }};</script>
+        <script id="i18n" type="application/json">{{ ui_strings | tojson }}</script>
         {% for name in [
             'modal',
             'navigation',
diff --git a/tests/integration/test_app_routes.py b/tests/integration/test_app_routes.py
index c2bcb0f..18e0a73 100644
--- a/tests/integration/test_app_routes.py
+++ b/tests/integration/test_app_routes.py
@@ -1,5 +1,6 @@
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -111,6 +112,37 @@ class TestEscaping(AppRouteMixin, unittest.TestCase):
         self.assertIn("&lt;script&gt;alert(&#39;config&#39;)", body)
 
 
+class TestContentSecurityPolicy(AppRouteMixin, unittest.TestCase):
+    def test_page_ships_no_executable_inline_script(self):
+        body = self.client.get("/de/").get_data(as_text=True)
+
+        inline = [
+            tag
+            for tag in re.findall(r"<script\b[^>]*>", body)
+            if "src=" not in tag and 'type="application/json"' not in tag
+        ]
+
+        self.assertEqual(
+            inline,
+            [],
+            "a host CSP can only hash an inline script whose content it knows, "
+            "and this one changes with every language",
+        )
+
+    def test_interface_strings_ship_as_a_json_data_block(self):
+        i18n._catalogs["de"] = {"Open": "</script><script>alert(1)</script>"}
+
+        body = self.client.get("/de/").get_data(as_text=True)
+        block = re.search(
+            r'<script id="i18n" type="application/json">(.*?)</script>', body, re.S
+        )
+
+        self.assertIsNotNone(block)
+        self.assertEqual(
+            json.loads(block.group(1))["Open"], "</script><script>alert(1)</script>"
+        )
+
+
 class TestApodBackground(AppRouteMixin, unittest.TestCase):
     def setUp(self):
         super().setUp()