LibreKAT/Ocideck
LibreKAT/Ocideck
Watch
4
0
Fork
You've already forked Ocideck
 0
Code Issues 2 Pull requests Projects Releases 4 Packages Activity Actions

fix(web): stop shipping doc-comments in web/index.html to every visitor #953

Merged
brenno merged 1 commit from fix/index-html-comment-leak into main 2026-07-29 08:33:10 +00:00
Conversation 0 Commits 1 Files changed 3 +50 -104
brenno commented 2026-07-29 08:33:02 +00:00
Owner
Copy link

web/index.html is copied verbatim into the web build, so its HTML comments travel to anyone who views the deployed page's source. The CSP/referrer/splash explanations there had grown into full documentation blocks duplicating (or exceeding) what's already in docs/SECURITY_DESIGN.md and docs/BUILD.md.

This trims those comments to short pointers and moves the actual rationale into those docs, where it serves maintainers instead of every browser tab.

Verified:

  • flutter test test/web_index_splash_test.dart test/pack_web_release_test.dart test/web_htaccess_headers_test.dart — green
  • full make check — green (6825 tests, no code changes, docs/HTML only)
  • make check-comment-language — green

No regression test added: this is a comment/documentation-only change with no functional behavior to regress (the existing web_index_splash_test.dart already guards the splash layer's actual behavior).

Reported by Jeroen Diel. Closes #952.

web/index.html is copied verbatim into the web build, so its HTML comments travel to anyone who views the deployed page's source. The CSP/referrer/splash explanations there had grown into full documentation blocks duplicating (or exceeding) what's already in docs/SECURITY_DESIGN.md and docs/BUILD.md. This trims those comments to short pointers and moves the actual rationale into those docs, where it serves maintainers instead of every browser tab. Verified: - flutter test test/web_index_splash_test.dart test/pack_web_release_test.dart test/web_htaccess_headers_test.dart — green - full make check — green (6825 tests, no code changes, docs/HTML only) - make check-comment-language — green No regression test added: this is a comment/documentation-only change with no functional behavior to regress (the existing web_index_splash_test.dart already guards the splash layer's actual behavior). Reported by Jeroen Diel. Closes #952.
fix(web): stop shipping doc-comments in web/index.html to every visitor
All checks were successful
scans / scans (pull_request) Successful in 3m15s
Details
7fbc3509ca 
web/index.html is copied verbatim into the web build, so its HTML comments
travel to anyone who views the deployed page's source. The CSP/referrer/splash
explanations there had grown into full documentation blocks duplicating (or
exceeding) what's in docs/SECURITY_DESIGN.md and docs/BUILD.md. Trim them to
short pointers and move the actual rationale into those docs, where it serves
maintainers instead of every browser tab.

Reported by Jeroen Diel. Closes #952.
brenno merged commit 1ea4d2190a into main 2026-07-29 08:33:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accepted
Assessed and will be built

  
bug
Something is broken

  
declined
Assessed and will not be built

  
docs
Documentation only

  
duplicate
Already tracked elsewhere

  
enhancement
New feature or improvement request

  
good first issue
Small, self-contained, and a good place to start

  
in-progress
Someone is working on this right now. Do not start it in parallel.

  
needs-info
Waiting for the reporter

  
privacy
Personal data can leak. Handled before anything else.

  
security
A weakness someone could use. Handled before anything else.

  
triage
Awaiting assessment

No labels
accepted
bug
declined
docs
duplicate
enhancement
good first issue
in-progress
needs-info
privacy
security
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
LibreKAT/Ocideck!953
No description provided.