fix(aggregator): pin home page Prism assets with Subresource Integrity

[yhabib]

Motivation

The aggregator home page loaded Prism's script and stylesheet from a third-party Juno CDN canister over the raw .raw.icp0.io gateway, with no integrity check.

A raw response is a single-replica query, not a certified response, so a dishonest replica could serve different bytes and the browser would run them with no warning.

Changes

• Switched both the <link> and the <script> tags in rs/sns_aggregator/src/index.html from .raw.icp0.io to the certified .icp0.io gateway.
• Added integrity="sha384-..." and crossorigin="anonymous" to both tags, so the browser rejects any content that does not match the pinned Prism 1.29.0 / prism-themes 1.9.0 bytes.
• Added a unit test, home_page_pins_every_external_script_and_stylesheet, that scans index.html and fails if a <script> or <link> tag loads an https:// resource without an integrity and crossorigin attribute, or uses a .raw. host.
• Added Subresource and stylesheet to .config/spellcheck.dic for the new changelog line.
• Recorded the fix under CHANGELOG-Sns_Aggregator.md / Unreleased / Security.

Both hashes were verified against a second source, cdnjs, and both files are byte-identical:

curl -s https://fmkjf-bqaaa-aaaal-acpza-cai.icp0.io/libs/prism-themes/1.9.0/themes/prism-vsc-dark-plus.min.css | openssl dgst -sha384 -binary | openssl base64 -A
curl -s https://cdnjs.cloudflare.com/ajax/libs/prism-themes/1.9.0/prism-vsc-dark-plus.min.css                    | openssl dgst -sha384 -binary | openssl base64 -A
curl -s https://fmkjf-bqaaa-aaaal-acpza-cai.icp0.io/libs/prismjs/1.29.0/prism.min.js                             | openssl dgst -sha384 -binary | openssl base64 -A
curl -s https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js                                         | openssl dgst -sha384 -binary | openssl base64 -A

file	Juno CDN (certified) sha384	cdnjs sha384
prism-vsc-dark-plus.min.css	UavePWn2zyHuZbvVQRu5n4XEhCiueqts8YR0Dqq1mnsearU03Jfxl1XSHffMI1kq	same
prism.min.js	06z5D//U/xpvxZHuUz92xBvq3DqBBFi7Up53HRrbV7Jlv7Yvh/MZ7oenfUe9iCEt	same

Tests

• cargo test -p sns_aggregator covers the new assets::tests::home_page_pins_every_external_script_and_stylesheet test, which fails on main (missing integrity) and passes on this branch. Verified with 4 mutations: a full revert, a dropped crossorigin, a dropped integrity, and a .raw. host, all fail the test.
• ./scripts/lint-rs, cargo test, and cargo spellcheck -- --code 1 all pass.
• scripts/spellcheck-changelog (the CI spelling job's second step) fails on main's dictionary and passes with the new .config/spellcheck.dic entries.

Todos

• The SRI hash must be updated by hand whenever the pinned Prism version changes. An HTML comment next to each tag in index.html names the exact curl | openssl command to recompute it.
• No test or CI job can check that a hash is correct, only that one is present. A wrong hash fails safe: the browser blocks the file and logs a console error, the SNS list still loads, and only the code sample colors are lost.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 39db1d1.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/c216d0ec-7005-4385-92fb-ac6c6dd345b7?scanId=958f81ae-9866-418e-aa3d-9258b567120d&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/sns_aggregator/src/assets.rs     Add test module for assets
Additions	► rs/sns_aggregator/src/assets/tests.rs     Add tests for pinned external resources (Subresource Integrity)
Enhancement	► rs/sns_aggregator/src/index.html     Update CDN links to use certified gateway and add integrity/crossorigin attributes ► rs/sns_aggregator/src/index.html     Document integrity notes in head and adjust script tag accordingly
Enhancement	► CHANGELOG-Sns_Aggregator.md     Pin home page Prism script and stylesheet with Subresource Integrity (SRI) and certified gateway

[Copilot]

🟢 Approved

The changes correctly add SRI pinning and a regression test without introducing functional or safety issues in the reviewed code paths.

Pull request overview

This PR hardens the SNS aggregator home page’s third-party Prism assets by switching to a certified gateway and pinning the exact bytes via Subresource Integrity (SRI), with a unit test to prevent regressions.

Changes:

• Switched Prism CSS/JS URLs from the .raw.icp0.io gateway to the certified .icp0.io gateway and added integrity + crossorigin="anonymous" attributes.
• Added a unit test that scans index.html to ensure all external <script>/<link> resources are SRI-pinned and not loaded from a .raw. host.
• Updated changelog (Security) and spellcheck dictionary for new wording.

File summaries

File	Description
rs/sns_aggregator/src/index.html	Pins Prism CDN resources via SRI and uses the certified gateway; adds documentation comments for updating hashes.
rs/sns_aggregator/src/assets/tests.rs	Adds a unit test to enforce SRI + certified gateway for external scripts/stylesheets on the home page.
rs/sns_aggregator/src/assets.rs	Wires the new test module behind #[cfg(test)].
CHANGELOG-Sns_Aggregator.md	Records the security fix under Unreleased.
.config/spellcheck.dic	Adds new words needed by the changelog entry.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.