mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-12 06:48:55 +00:00
denkfabrik-li
7264c44fd7
app.blade.php is the root template for all three interfaces, and it opened
with two lines pointing at a third party:
<link rel="preconnect" href="https://fonts.bunny.net">
<link href="https://fonts.bunny.net/css?family=instrument-sans:400,500,600" rel="stylesheet" />
Every visitor to /login, /register, /forgot-password, /s/{token} and every
public listing page therefore made a request to a host the operator did
not choose and could not switch off, before they had done anything at all
-- handing it their IP address, their user agent, and through Origin the
hostname of the installation they were visiting. On the signed-out pages
that is a visitor who has agreed to nothing, and an operator who often has
told their own users that this server is where their files live.
There was no self-hosted copy in the repository, no setting, no mention in
INSTALL.md, DOCKER.md or SECURITY.md, and no SRI on the tag.
The font now ships with the application, through @fontsource/instrument-sans
-- the same font, the same three weights the URL asked for, from a
versioned dependency rather than binaries pasted into the repository.
Vite fingerprints and emits them like any other asset.
Cost, measured on this build: twelve files, 192 KB on disk. A browser
fetches only woff2 and only the subsets it needs, which is 73 KB for all
six woff2 files together and typically 41 KB (latin, three weights) for a
page in English. Against that, every page load loses a DNS lookup, a TLS
handshake and a round trip to another origin, so signed-out pages get
faster rather than slower.
This is a privacy change rather than a vulnerability fix, and worth saying
plainly: the share token does not leak this way. Referrer-Policy:
strict-origin-when-cross-origin is set in both nginx configs and in the
INSTALL.md snippet, so the path never travelled in the Referer. What
travelled was the visit itself.
Not changed: public/.htaccess still sets no security headers at all, so an
Apache installation has no Referrer-Policy. That is a real gap and a
separate change.
Verified: `npm run build` succeeds and emits the faces; no reference to
the CDN survives anywhere in public/build; `tsc --noEmit` and prettier are
clean. No test asserts on the font, before or after.
81 lines
2.8 KiB
JSON
81 lines
2.8 KiB
JSON
{
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"build": "vite build",
|
|
"build:ssr": "vite build && vite build --ssr",
|
|
"dev": "vite",
|
|
"format": "prettier --write resources/",
|
|
"format:check": "prettier --check resources/",
|
|
"lint": "eslint . --fix",
|
|
"types": "tsc --noEmit"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.19.0",
|
|
"@types/ws": "^8.18.1",
|
|
"eslint": "^9.17.0",
|
|
"eslint-config-prettier": "^10.0.1",
|
|
"eslint-plugin-react": "^7.37.3",
|
|
"eslint-plugin-react-hooks": "^5.1.0",
|
|
"prettier": "^3.4.2",
|
|
"prettier-plugin-organize-imports": "^4.1.0",
|
|
"prettier-plugin-tailwindcss": "^0.6.11",
|
|
"typescript-eslint": "^8.23.0",
|
|
"ws": "^8.21.1"
|
|
},
|
|
"dependencies": {
|
|
"@codemirror/lang-css": "^6.3.1",
|
|
"@codemirror/lang-html": "^6.4.11",
|
|
"@codemirror/lang-javascript": "^6.2.5",
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@fontsource/instrument-sans": "^5.3.0",
|
|
"@headlessui/react": "^2.2.0",
|
|
"@inertiajs/react": "^2.0.0",
|
|
"@radix-ui/react-avatar": "^1.1.3",
|
|
"@radix-ui/react-checkbox": "^1.1.4",
|
|
"@radix-ui/react-collapsible": "^1.1.3",
|
|
"@radix-ui/react-dialog": "^1.1.6",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.6",
|
|
"@radix-ui/react-label": "^2.1.2",
|
|
"@radix-ui/react-navigation-menu": "^1.2.5",
|
|
"@radix-ui/react-select": "^2.1.6",
|
|
"@radix-ui/react-separator": "^1.1.2",
|
|
"@radix-ui/react-slot": "^1.1.2",
|
|
"@radix-ui/react-toggle": "^1.1.2",
|
|
"@radix-ui/react-toggle-group": "^1.1.2",
|
|
"@radix-ui/react-tooltip": "^1.1.8",
|
|
"@tailwindcss/vite": "^4.0.6",
|
|
"@types/react": "^19.0.3",
|
|
"@types/react-dom": "^19.0.2",
|
|
"@uiw/react-codemirror": "^4.25.11",
|
|
"@uppy/aws-s3": "^5.1.0",
|
|
"@uppy/core": "^5.2.0",
|
|
"@uppy/dashboard": "^5.1.1",
|
|
"@uppy/locales": "^5.1.1",
|
|
"@uppy/react": "^5.2.0",
|
|
"@vitejs/plugin-react": "^4.3.4",
|
|
"axios": "^1.19.0",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"concurrently": "^9.0.1",
|
|
"globals": "^15.14.0",
|
|
"laravel-vite-plugin": "^1.0",
|
|
"lucide-react": "^0.475.0",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"recharts": "^3.10.1",
|
|
"tailwind-merge": "^3.0.1",
|
|
"tailwindcss": "^4.0.0",
|
|
"tailwindcss-animate": "^1.0.7",
|
|
"typescript": "^5.7.2",
|
|
"vite": "^6.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"@rollup/rollup-linux-x64-gnu": "4.9.5",
|
|
"@tailwindcss/oxide-linux-x64-gnu": "^4.0.1",
|
|
"lightningcss-linux-x64-gnu": "^1.29.1"
|
|
}
|
|
}
|