From f8efcf136ac25725712c85688d6b6a1f50d52ef0 Mon Sep 17 00:00:00 2001
From: Ferdinand Urban <urban@team-tradeo.de>
Date: Wed, 3 Jun 2026 12:33:34 +0000
Subject: [PATCH] fix(security): add SRI to SheetJS CDN +
 Content-Security-Policy (#6)

- SheetJS <script> now carries a sha384 integrity hash and crossorigin so a
  compromised/MITM'd CDN cannot inject code.
- Adds a CSP meta: default-src 'self'; script-src limited to self +
  cdn.sheetjs.com; style-src self + Google Fonts (+inline for app styles);
  font-src gstatic; object-src 'none'; base-uri 'self'.

Verified headless against localhost: no CSP violations, SheetJS loads with
a valid integrity digest, app.js renders normally.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 index.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/index.html b/index.html
index 3182f07..23c31b4 100644
--- a/index.html
+++ b/index.html
@@ -3,12 +3,13 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.sheetjs.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; object-src 'none'; base-uri 'self'">
   <title>Morning Meeting Planner</title>
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=Space+Grotesk:wght@400;500;600;700&display=swap" rel="stylesheet">
   <link rel="stylesheet" href="style.css">
-  <script src="https://cdn.sheetjs.com/xlsx-0.20.3/package/dist/xlsx.full.min.js"></script>
+  <script src="https://cdn.sheetjs.com/xlsx-0.20.3/package/dist/xlsx.full.min.js" integrity="sha384-EnyY0/GSHQGSxSgMwaIPzSESbqoOLSexfnSMN2AP+39Ckmn92stwABZynq1JyzdT" crossorigin="anonymous"></script>
 </head>
 <body>
   <header>