Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Inline event handlers in sub-app HTML survive the build: dead under CSP, and a dark-mode leak without it

Chiusa
  • Qualcosa non va?
#67 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@oto-macenauer-absa ci sta già lavorando.

Dal 14/8/2026.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
50/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
html, javascript
Ambito
build-system, documentation

Direzione di ricerca

Start in src/utils/transform.js, where inline <script> handling is implemented, and add policy logic for on* event attributes in the same transform pipeline. Check scripts/hoist-inline-scripts.js and the docs-example onclick snippet for expected behavior, then extend tests/build-integrity.spec.js so it asserts the output has no inline event-handler attributes. Update contract/HEADLESS_RULES.md accordingly; done means tests pass and the new invariant is documented in that rule file.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

The "nothing inline in the output" invariant is enforced for <script> elements only. Inline event-handler attributes are neither hoisted nor stripped, and script-src 'self' blocks them exactly like an inline script.

The vendored docs-example fixture ships one, and it reaches dist/:

<button id="theme-toggle" aria-label="Toggle theme" onclick="
  const r=document.getElementById('docs-root');
  r.classList.toggle('dark');
  localStorage.setItem('theme',r.classList.contains('dark')?'dark':'light');
">

Two problems

  1. It is dead code in production. script-src 'self' with no 'unsafe-inline' blocks inline handlers, so the button is inert and logs a CSP violation when clicked. scripts/hoist-inline-scripts.js exists precisely so that already-published bundles keep working under the policy; it does not cover this case, so any doc app whose interactivity is written as onclick= is quietly broken instead.
  2. It is a light-only leak wherever the CSP is absent. astro dev and astro preview serve no CSP, so there the toggle works and adds dark to the sub-app root — the exact thing transform.js strips the theme bootstrap to prevent (#48).

tests/build-integrity.spec.js asserts every <script> has a src, which is why this got through. Nothing asserts on on* attributes.

Suggested fix

Decide between the two available policies and apply it in src/utils/transform.js, where the document is already parsed:

  • Strip on* attributes. Honest about what production does — the handler cannot run anyway — and closes the dev-mode dark leak. Cost: a doc app's inline interactivity disappears rather than failing loudly.
  • Hoist them, the way <script> bodies are hoisted: turn onclick="…" into a listener registered from a generated file. Preserves behaviour, but needs a stable element handle and is a good deal more machinery.

Either way, add the assertion to tests/build-integrity.spec.js so the invariant covers attributes and not just elements, and say so in contract/HEADLESS_RULES.md — this is a rule onboarding repositories need to know about.

Separately worth deciding whether the docs-example fixture should keep shipping a dark-mode toggle at all, given the marketplace is light-only.

Lingua principale
JavaScript
Stelle
0
Fork
0
Merge medio
20m
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di AbsaOSS/knowledge-base

Tutte le issue di AbsaOSS/knowledge-base

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.