From 0523dc9d796b654be5dbea1a0046f208c531b0fc Mon Sep 17 00:00:00 2001
From: posimai <posimai.project@gmail.com>
Date: Fri, 17 Apr 2026 18:42:14 +0900
Subject: [PATCH] fix(security): add SRI to d3 CDN, fix XSS via innerHTML in
 detail panel, noreferrer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 index.html | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/index.html b/index.html
index c432f62..65a5a71 100644
--- a/index.html
+++ b/index.html
@@ -1249,7 +1249,7 @@
                     <div class="metric-stat-val" id="metric-sessions">—</div>
                 </div>
             </div>
-            <a class="metric-open-btn" id="metric-open-link" href="#" target="_blank" rel="noopener">
+            <a class="metric-open-btn" id="metric-open-link" href="#" target="_blank" rel="noopener noreferrer">
                 <i data-lucide="external-link" style="width:12px;height:12px;stroke-width:1.75"></i>
                 posimai-dev を開く
             </a>
@@ -1480,7 +1480,7 @@
 <div id="toast" role="status" aria-live="polite"></div>
 
 <script src="https://posimai-ui.vercel.app/v1/base.js" defer></script>
-<script src="https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js" integrity="sha384-CjloA8y00+1SDAUkjs099PVfnY2KmDC2BZnws9kh8D/lX1s46w6EPhpXdqMfjK6i" crossorigin="anonymous"></script>
 <script>
 // ── Constants ──────────────────────────────────────────────────
 const STORAGE_KEY = 'posimai-atlas-data';
@@ -1870,7 +1870,18 @@ function showDetail(id, simNodes, simEdges) {
 
     const urlEl = document.getElementById('dp-url');
     if (node.url) {
-        urlEl.innerHTML = `<a href="${node.url}" target="_blank" rel="noopener"><i data-lucide="external-link" style="width:12px;height:12px;stroke-width:1.75"></i>${node.url}</a>`;
+        const a = document.createElement('a');
+        a.href = node.url;
+        a.target = '_blank';
+        a.rel = 'noopener noreferrer';
+        const icon = document.createElement('i');
+        icon.dataset.lucide = 'external-link';
+        icon.style.cssText = 'width:12px;height:12px;stroke-width:1.75';
+        a.appendChild(icon);
+        a.appendChild(document.createTextNode(node.url));
+        urlEl.innerHTML = '';
+        urlEl.appendChild(a);
+        if (window.lucide) window.lucide.createIcons({ nodes: [urlEl] });
     } else {
         urlEl.innerHTML = '';
     }