From b098453d0cf61669cb8e2847ef68ad9ecabc0c4f Mon Sep 17 00:00:00 2001
From: Chocobo1 <Chocobo1@users.noreply.github.com>
Date: Sun, 9 Feb 2025 18:07:51 +0800
Subject: [PATCH] WebUI: require Subresource Integrity on external links

Also migrate to .mjs format.
---
 src/webui/www/.htmlvalidate.json | 12 ------------
 src/webui/www/.htmlvalidate.mjs  | 20 ++++++++++++++++++++
 2 files changed, 20 insertions(+), 12 deletions(-)
 delete mode 100644 src/webui/www/.htmlvalidate.json
 create mode 100644 src/webui/www/.htmlvalidate.mjs

diff --git a/src/webui/www/.htmlvalidate.json b/src/webui/www/.htmlvalidate.json
deleted file mode 100644
index 5dae7718d..000000000
--- a/src/webui/www/.htmlvalidate.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "extends": [
-    "html-validate:recommended"
-  ],
-  "rules": {
-    "input-missing-label": "error",
-    "long-title": "off",
-    "no-inline-style": "off",
-    "no-missing-references": "error",
-    "prefer-button": "off"
-  }
-}
diff --git a/src/webui/www/.htmlvalidate.mjs b/src/webui/www/.htmlvalidate.mjs
new file mode 100644
index 000000000..b39ef1db3
--- /dev/null
+++ b/src/webui/www/.htmlvalidate.mjs
@@ -0,0 +1,20 @@
+import { defineConfig } from "html-validate";
+
+export default defineConfig({
+    extends: [
+        "html-validate:recommended"
+    ],
+    rules: {
+        "input-missing-label": "error",
+        "long-title": "off",
+        "no-inline-style": "off",
+        "no-missing-references": "error",
+        "prefer-button": "off",
+        "require-sri": [
+            "error",
+            {
+                target: "crossorigin"
+            }
+        ]
+    }
+});