web: Fix unsafe HTTP script loading in Web GUI - #11183
web: Fix unsafe HTTP script loading in Web GUI#11183jorge-ferreira-pii wants to merge 2 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request vendors several third-party browser libraries (leaflet, golden-layout, three, elkjs, netlistsvg) to ensure the web viewer and saved reports can run completely offline without fetching code from CDNs. It introduces an asset-locking script, updates both Bazel and CMake build systems to embed these assets, and implements C++ logic to inline stylesheets and images as data URIs into saved reports. The review feedback highlights two important improvements: first, using generic_string() instead of string() in resolveAssetPath to prevent path resolution failures on Windows due to backslash separators; second, using the noexcept overload of std::filesystem::remove with std::error_code to avoid potential crashes from thrown exceptions.
jorge-ferreira-pii
changed the title
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
The viewer and the saved report loaded leaflet, golden-layout, three, elkjs and netlistsvg from CDNs, one of them over plain http (issue The-OpenROAD-Project#11065). They are vendored under src/web/third-party, embedded in the binary and served by web_server, so nothing is downloaded at build time or at run time. Signed-off-by: Jorge Ferreira <jorge.ferreira@precisioninno.com>
WEB-0044 and WEB-0045 collided with saveDisplayControls, which landed while this branch was out, so they move to 77 and 78. TestCssInliner pulls in web.cpp and needs the headless gui stub under CMake, as its Bazel twin already declares. Signed-off-by: Jorge Ferreira <jorge.ferreira@precisioninno.com>
fedd4f7 to
a55212f
Compare
2 participants
Fixes #11065