T08 · Insecure Dependencies
Warning
- Location
components/base-template.html:7- Finding
Automatic Loading of Mutable Third-Party Stylesheets and Fonts
- Content
View full analysis
``` The examples and design-system documentation also use the following external import: ```css @import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800&display=swap'); ``` ### Technical Analysis The starter template and both example reports automatically establish connections to Google infrastructure and retrieve remotely hosted CSS and font resources whenever a report is opened in a network-enabled browser. Although the resource is a font stylesheet rather than executable JavaScript, its contents are mutable outside the audited project. Consequently, the rendered result depends on a third-party supply chain that can change after the project has been reviewed. This also conflicts with the project's characterization as a single-file report and reduces the reliability of offline operation. The requests can expose ordinary browser connection metadata to the external provider. Depending on browser policy and hosting configuration, request metadata may include the client IP address, user agent, and referrer information associated with the hosted report. No evidence was found that these resources currently serve malicious content, so this is a supply-chain and privacy weakness rather than confirmed malicious e ...[truncated 1203 chars]- Remediation
View remediation
``` 6. For hosted reports, consider a Content Security Policy that restricts resources to approved origins. A fully local configuration should prefer: ```http Content-Security-Policy: default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' ``` 7. Add an automated check that rejects unexpected external URLs in generated reports. ]]>