From 0fcfb9ab24861d2c0a71405d9171d574e5e469a9 Mon Sep 17 00:00:00 2001 From: Jason Chuang Date: Wed, 19 Aug 2026 21:12:33 +0800 Subject: [PATCH] wcag local image --- docs/csp-apache.conf.md | 6 +++--- src/assets/images/wcag2AA.png | Bin 0 -> 11526 bytes src/components/cards/AuthFooter.js | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-) create mode 100644 src/assets/images/wcag2AA.png diff --git a/docs/csp-apache.conf.md b/docs/csp-apache.conf.md index fa0587c5..c7d578e7 100644 --- a/docs/csp-apache.conf.md +++ b/docs/csp-apache.conf.md @@ -21,7 +21,7 @@ Header always set Content-Security-Policy "default-src 'self'; \ script-src 'self'; \ style-src 'self' 'unsafe-inline'; \ style-src-elem 'self' 'unsafe-inline'; \ - img-src 'self' data: https://www.w3.org https://w3.org; \ + img-src 'self' data:; \ media-src 'self' blob: data:; \ font-src 'self' data:; \ connect-src 'self'; \ @@ -42,7 +42,7 @@ Header always set Content-Security-Policy-Report-Only "default-src 'self'; \ script-src 'self'; \ style-src 'self' 'unsafe-inline'; \ style-src-elem 'self' 'unsafe-inline'; \ - img-src 'self' data: https://www.w3.org https://w3.org; \ + img-src 'self' data:; \ media-src 'self' blob: data:; \ font-src 'self' data:; \ connect-src 'self'; \ @@ -54,7 +54,7 @@ Header always set Content-Security-Policy-Report-Only "default-src 'self'; \ - **`frame-src`**: Required for proof file preview iframes that use `data:` / `blob:` URLs (`UploadFileTable.js`). Without this, framing falls back to `default-src 'self'` and browsers report `frame-src` violations (often with empty `blocked-uri`). - **`style-src-elem`**: Explicit, alongside `style-src`, for `` behaviour in modern browsers. -- **`img-src`**: Includes `https://www.w3.org` and `https://w3.org` so W3C WCAG badge URLs are allowed. +- **`img-src`**: `'self' data:` is enough. The WCAG 2 AA badge is bundled locally (`src/assets/images/wcag2AA.png`) and no longer loaded from `www.w3.org`. - **`media-src`**: `blob:` for captcha audio object URLs; `data:` for data-URI media if used. - **`font-src`**: `'self' data:` covers bundled fonts and `data:` URLs if used. - **Report noise**: Browser extensions (Kaspersky, Perplexity, Youdao, Quark, Google Fonts injected by tooling, `wasm-eval` from chrome-extension) will still appear under Report-Only. Do **not** allowlist those origins. diff --git a/src/assets/images/wcag2AA.png b/src/assets/images/wcag2AA.png new file mode 100644 index 0000000000000000000000000000000000000000..b706d1f57d01a55c6b8becccf4c41bd3dd906e1b GIT binary patch literal 11526 zcmc(FlCOYtJ{w6gGc)@a4 zGV}t0-gf?bAi+$%D}WCvz2yzOwcYHz!Iqx3ATSur?cnO6o6J>Jko^P7U68ss;M;gsCID z+S_BWvX+_|lUQ!gt$;4K@Qi*$}wblZ^7lF^ujlP$jSadK$anGoh>V{B{Ui5l68dKY8d1&KvM z>GEp8nya@J*xII2#=>uHe~B9})Ccm|00?CXe^{E6cYI-{bFsjZr|P_@*t61$++Hq7Hnl zm?iw674to5l`50L(Y8s216QyTqBk5ZTqh($jp721wc_U?@=oIULC>f}W=o~1e&Evg z<$a}6PcfOpz6{M}>gUJacKv5+GsF2x+%je!oib;}dh?0OAI^K}r9=ucfZvx@zPL6M z4FfNl@%J2^;VbpTnXw9eHSa-c8aWf!W;mh);;3%kIv9L9o{!~MFB@mbbJE|IM_IVQ z6q86TNC6+5q^GWb9;~v`fRKddmz8+vF)jxQZrB4NCjJ6 zQH4SGbRx|bb$~M;khg_m!YI7|tZjn@>%ERHJg5Gx*=@ZpOVzpnNCWEaINxf&UL z?h^gYRQk}_V-wqU?3_Eh;~+CLkGIL@WY3+x`{ksp9-TeBXY^!MF6K< zyqaPClyuP}pRbRYgRnO=mA4rjkuWBb509tX!uXUB z$H@Ydt{{vl(YUFRXm*L;^C)I0cv_le@`mZeG18VrX z?}hho1qT**niNX~k?IrFD_EO)(wt-VUJ_%9T((4Oqe(Ja3p4i4D?A#a<`n4fgQMkD zfqD)d`j3r^@n~}3qZ_9(=K0sb?Nhs?B}{@uy6x~xOak2Fb9TR)$;S?kO2Ko$>^60l)GV`fz9cACb<|J3{cK z1~}iC7qe-Be?Y;HLFhk}r~IbENo&R%UtaqlP(<*_<$h?s9i7*sC*M{4@r%DMtVj9X z`DE&cCK4Pp=`;j#+^=x2`=Tt(3X?na8OgC{>GIS!+HWcAq(!8LsX0QpKqB#YxK1b=I?(m_~ZOUIYPWKpkOvLh_ z$n6Fm_);{RD%?-B;w**+4j4~_BYqiKBAq8q`pdR%czV6IOMF7KQ!Z?fb|L%ESp}5O zB`ArKsARnKjz!Hq(8g@l1a86~EePnMCoX?6Z<^j^cB5RkAnb8ay?X8+zBg1vp_Cov z&lMfVeTLgSYSeJ+)yn<%KGq@-q-8vU~}LtSpill%@Mss{kMUc=vj5g_F-H zWK#4aTL?AKXWj*Kr&S=8WS}t`x}_CGC7Tb~q$--#WU>+@11}#)dL{27(B5*I&~mlw zyjM@Wive=6#x>-N^%Fl!ndQQ>AqE1f zKRGg9(J)(lv6Y_XW3p)Sxjfb&>jH~bG1C5IkXMM(dI~ML;-NKG)$}~J| zgY2B%iFKl`NukW?4V?VsHbJKU()xZWn2c9R+bMJXq9!eKa*fO@5v}}dhk5PY!(gr` z_aOf6*BHhzivphS@Z^rLx1^g-xDsN4f4PZk5kfrYS}W&B`u(e^6W--oF+O1lS+CbGQ^C2)u6C%s5$K5pC#45!0_Jx--; zT5*FJM*a*Tn{&}7q4D(wm>O51o5Amq^$-Dgqjwu93Uv5-u%|4nOscJ-MV}m_G{2w; zEN98#(^;I$+TmMWg1EMYk`C;k-%@zSJP_%3IL{T9#oYq=d14^dq3GT|6BCwfLbS9b zgHQ<^sk}cjc5$_h`&Lfja7EPZa%IE|+R7XsFl$`W+=rghVaIm0pTiG_uQwm{wlf*? zKP&a*z)eg`du9>_GsRR|{GvHvndU2D^Tz+x2B=bD;r5TY{*y|UZM zlft*B64q9{$G&sEm*k@kHGCsi@g=>nYukHc3_t^1DTm*`=}jS~h}--$muEp{eSfh1QmMoHYlo&_AroHZ<-_7w>c3+h2& zeq)Ueq)o>V(tIN@l_if$@8ykF-U1}AuFZ}UeupcY;Wo6R;CaS;NKQ$j6}Y$8-)3(s9}`|s6zl=m-VbCn51Y((vGfzde2|&Mr_w+Z`68XuM$k(sZuAG z91Ck5cH4Vp!Brfy-PuzECDIAw{yZY6q9nCPCsgD*+VG4gj~55Jf7HE5)jt``z_^7o zulsJHqj$IAnbWE$R?u}yzj^tJ+~R;*yw>qtu(QUJQvu&IvNidvd4!kTuho&NOgk>>wsPr~tZHy=5Oa?D|l8yXJJG)Ke4*K@DzKob@KZX!0e!Gu?F~ZG-c7 z5BA9y$;K7a+)abTRlU>>&i_C{S-P>c^&aEDX6Ga9f$&^Dg7^J4P}_?1P|hDcDG5S+ zVZLfVN*fv)cS`6dcYZ(TN(a)jD>l`AW@P%-{i9U8GLbmlc2ZF-s=bV2$e{nbalA?8pCpJQq5%Sg==Hrrb&U>+qJljLl3I0%7Uj3ov96vqz_Rbs{D^A=$#uoxLxg48I>7127X^>t4y(dH$D@c2Zr62(#MZ-j)U)9ZKd zwKkZ?ERLE2Vtjfz&fKh@O%}Ah2?K%P7=`VjiC> z;p+0be~IlbC-s%Myz?xx>3obvExl^rX;lzA*e@wx}?!&UKuS5vpu0My7tA87jxB@uEm@4GU@1uPVEBm`6qM`6eLZ@WJKhmJ zk1^|hALDyYP%amdG^G}nn$*%%3dSyY(=|DO2i<%B+smh6p!TV{LqJ$ise~wzkfLWg z@415yUs#pO{p9OYWLPUN0EG_`aUHHy1rRq-OQ;ngfdAyzyq@L=WssyoT2X}o1UNE+ zMNf1VK`)sZbzejK9|wjxr?$ew=Gfv;JUdgH@!@5W>WCZe!JdLLSEYh$mb zzg%8M!W<7N)MyUS+*q9e#9CYbMzJLWCI1u7@F2mS6?9Dd#leCuu2~*!TnkcgjYG(% znzs^i_?M)!)<(`kqW~+Qshghn`&*9X{x645^!*``v!pn!lp&9Bn{`PRV0TNju-aw+EdgYG{ts&q9E!hd@7TO{ zK4$xk$&qVH=9tFB2Y4WLrc#!49GV1u-x?MW9S?pEuzC4t3PUlRWeOrZoWdX7P4kkf zU7#K7b3=PXh&{OtF*pZX@=MUb2GyC6h+-a?{Ra^S65J$0Wc-{|)bU_?nxQ~5H>L&h ziL~dc;6#xZvx8UXiJeI_?NV9EDf#sCJJo@a?{Yot5W$&JY27ihiL0*y!g3BU7^g2c zGx@bzhGf;gU&PISLR=d;zIwKezUEr z2}7Y>IO9l&We6PZhYfo%^Sy+~d&}1VLrqIT{t|3muK4lI2Y2+JOOSIv+DbRPdXa|` zZ`S5Ad{%$YK0!YbKC)GwD~K^-uqs7bPVU^4xexD)j1y%TR!Hs@J1=hB;q(GR1E zPF!P=B$JhRwz+XNE5fZ0S^PxO%}+*;johEapd1BNC8GAdmB^2w#h!NX64u5bkVMTl){FGarBXhP(8rbych?W?%;KuhLiuqNc4W2BF8uR(!i38 z8-OgczT*x3nbskmC3W#<|G9}*xc^)42~tbUk2cL-lD{u{U5(Oj4#$l@?kRUuElz23 zr{+UJbyj=X)?ij-LzC&~PK`7T>*pqA!hz0k8EwKSvHMFbk+JxEu_fyC zXPm3w)uBZl;aRTwW{VL{(I+|*d}|oDGBXRwRm#HuV4`!od*pQ{JO*QP%iz?Tt?L%K zM`I{55x6{@NcF#2l)D%L=J1 zC}DG5wpde6a?i2Li5bp0p+=_CO8oNZ`3~35Kn}yUmPOQ?HA2u<=TSkCL4*3=fsjJ2 zG;kn;3&?y0ClV{vyLh?s9Qs!rqS|}KM9Sphv@fS8O}tJc27tDYHBfXnifZ6{eg6teY`)U4z>@Hc4qXik4fMgzLxzl4G=>ld7{I zF&Y`dV1h^-7-#r530I{3>aN@g##+wrjVe_NRw|3f-{#(2s^`5>p?~v6e*S&SbLu;a zr#}jHS3&wS3S!V zoGCB9#&vJ);QZX2nuO-&-_EDpY8cl-aA!5Kg*%BLlQ`v@KT4LFLX{y@aER*N&u07O zdZab?HB+nSbzSe7FU8*q+HVc@Z-!A7pdFFjqy;6~i_((NKZ%T8g+HScY?ZMe! zEr3#xhB!vYQ7}C?5Iq$=pnv%e+EZK_Nm_GUTG=FDi^3#B2$oX#-NTA^WoKsq>c(;U zmvh>!93=OsxgUZAUB5+)Dwx=-P4lIy@LGSmg!8tn7;Z;XM!FxKdu`cGt&z8ORHJRs z9Ir@kY@~(qR%#Rw$Phx&6<)ZjhF{(6P|_lYyll)A*y)=wO1_ksk71;{8%M&P!y@yY}DxMKf4jdow{%^P|_`CbmuGkUohJ{@O!x?Sj0&eycftk^4BBU10u3Q<6t_;t)DqW0Ys4@_03Kkss{z^8fmjdWm zZb0S>1iL%8#FlA!{98W;w#}OCp9Zfc;fIGFYjw>2(y<)7mk9D;AlaQ|9&jR;T`Yo#Zb?9ZOi$Vf{U>T$??BkO2 z)MC9uh@j=V`9*T?UJw7LdU0@MoeNKQ6H77F3~_HH7WRSbEO70$0j;*N@)}-*vgPU) zT_<+OIb$!J+q(?52RjHepr;unaqVAQIJm~ZW9m!up=6DCRWOS++sf6fxFa#&$#yy9 zft1VPzz>Qzlb_$b%n)F|I8iKhKNEHpUNc`bk!$Hj>GHEp)ckq*iAB7dEcE__rnKOt zK&q9i2}2O%ULZdp!U&Jk+=tBY9^%#y2tpUI+z^HK=gu%q)|F&Tk9k9r0a&--_@}ul zis2#Im^kF>xJfm-zj)^MXHplx(9z5uwmJ@+f}42KTHV5$eHD_@Ac^(*e)gVYM|=R) zU*<|;zBF5=VRbi*ad|BQxpTM>7WC)v6O(|*s>pX!1S;7Xu)&mdqjDCm#zvs(%85tHUIN# zpurwm*pk~#Z4D-=I`!M5XZ_8`H>SjKyt#QV%NcZx`7Nq9%LrAHfsryDM~TMmmyXm8 z-HLnw_czO-&e+}1+rx4E>eS9s91X4BXNC^L|H2Ua z-UK5F1wb|#<6}L)uj+i~rVi#%NMTS*xQI4+wR>7yDnky9ive1+-)$*Q#IW+qzC5B< z_ol`kb36IXDy|F>XvLgkB?L~rK=-EyKpL2y&5?DcNx5}mG#_|gIOD;uDlymVU@$f* z&hM1rX@SvPi0j3%c2wiRLSUw!22$7uxj4ATH zYH#`4&|KYYlRXeo_9AU7hD>@XXJJ;c{Bme5AMpst#wzNW`Pk=@pqUTpLMLsxDN}bP z+hdUqOW+a>jgEea)5|>wTQ5BHCiX=pJ#q1DwomWme>6GYzt1^s*W}4J-dj{JpbQ%T^0ei-!x`Dc+OikFxqU_&#ek%=9jSxw~}kvDL!!(C@>@%( zgDFqhJI|lK&skYT2tvvQA3Vu3A%ol>h`?Vi9|wD{!9QU~?QacptLZ{NoCgy#pkGfJ z9*RBGEw*%WNN(O!*m?}~BHVi|x%yM!!-un!xzNe}K0e0JM~1Jrot?q~Xn6aPHfCUX zoe2I+n{vLM)E{rJxP2dsVZC0=Fito1tYKgBdByM=s=b&tXX5H{NZzxiQ5DJn^$i}PqY$6F~p!mf)1x+Dhx?R&G1qB`3j@@YWa!1kyoSKu$LNs)5y)~{edEK?H z{yO@>eV7RYXl1qWn(K7JJqh|@(Y3%>F^5V253zfN27Rkpw_2oSrN#+@&-rzHC5#hP z|R$3q)~cCd97Ir;$?{!gT?LO3;-TE`$oWUVIe6%;DK@eZ~e3V1V=FM)9r z=;pdk&qD*8L9qQVB;#{m#P3|HOhm9b$dmb3ZkxM$Xy^FJP=aVK4+|-R+St&W9do`I z86=IOqXE<7=PczdD<>oZ3=SZ_DO_S~f8=nj=LzGUPg2LM{M55apJM`Qu`V8MpCwC1 z@A43`W&Ryd+lWstKB~O5*K>a;v1XF6crAPa&GXk@z4)vI;>pK|PRU7157S?0`UgK; z)wh3veM)|Ik#^H8KrwcqVna1D3qdIiRG(P za|yI;>M=lp*ZZ=v8X9V&z-I6MaFeEGGFD*mlN)e2yc*2N(au81uLoFB(3}R)Ss$pq z6KLMVZgt?KfEz9zzy4P#MBlCcq9y!WHh*v&t{m=OJO7k_rAqCtG^L}MrZTZSD$R6A zcrw`{Zp?=`1x^AUk$ayF>?q^Sr9 z1CQZ*W7N@YL%rgvaIZNei{mYc$%S^}82{d>$aVwgM-3kJF@xpmzL>SP#w@N1$DuP~ z;l?K8(TR)cZx)kY0L3x>eY7(L!nR$&NmBUXx+Y2gV$bo+&bDb`Z>iN$tPq2W=Q@UE zQ#Sa$0kRt|l6_jA_^R=RFC6EhPTo~BZ{g0(*JiVExR8PLUZI|kkJ^RC?In_#?^2LP z;AT9!9^*p!H?875J!_5Hvm%0X!GFr@7!V>$qjdm$KR)oF#Qz)xLpIW}A6eR9hKLAAF^bWLs z#&0DV=-*(rzpnZjC;A}uqV+u_m(#<0!nr7+ImUwC1*-PX$fe+Wel==z>L}-=N*M&f z74LIKsNc=yeNPSl)3y1zpeD zFl(vCDgp!o>|<4fh9**z%^;^G%LTD>DIk0#K~_n$!n;IFdReLX`; zJHj4c-dIbcYzOAFns%=PDJHIaJ98^8%YMTIFk`w({^%m*)%fjN4Dh4iwQ;AP`vY1zy4Q`0{g)0Es{~;{}h(47#bvCUK)7CdT+H-`IoNE1Y<>0dw9tIvlXN^O6UZW^5<@5P`BcRKt>l>#($J(9e@`L}e%!SigG<+f* zYoIWHyuR1Wt=AP4uwB)4RHHnMRAz3_X0ji+I{|-ma!K}a`yg%h+qa|tk2>Uh-|QW- zG#T=bx77_mkjLv<_ literal 0 HcmV?d00001 diff --git a/src/components/cards/AuthFooter.js b/src/components/cards/AuthFooter.js index ce769601..398e99fa 100644 --- a/src/components/cards/AuthFooter.js +++ b/src/components/cards/AuthFooter.js @@ -1,6 +1,7 @@ // material-ui import { useMediaQuery, Container, Link, Typography, Stack } from '@mui/material'; import bhkLogo from 'assets/images/BHK_logo_rgb_zh-hk.png'; +import wcag2AA from 'assets/images/wcag2AA.png'; import {FormattedMessage} from "react-intl"; import {useIntl} from "react-intl"; import { @@ -62,7 +63,7 @@ const AuthFooter = () => { {wcagAlt}