Giters

applegrew / django-select2

This is a Django integration for Select2

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Use https://<cdn>/ rather than //<cdn>/ for security?

hartwork opened this issue · comments

commented

Hi!

I noticed that there are a few places in here where CDNs are referecing using //<cdn>/ rather than https://<cdn>/. To my understanding that makes requests go through HTTP rather than HTTPS without any gains. Am I missing something? Would you welcome a patch?

# git grep -h "['\"]//" | sort -u
        assert f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/css/select2.min.css' in result
        assert f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/select2.min.js' in result
    CSS = '//cdnjs.cloudflare.com/ajax/libs/select2/{version}/css/select2.min.css'.format(version=LIB_VERSION)
            error = driver.find_element_by_xpath('//body[@JSError]')
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/de.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/en.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/sr-Cyrl.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/zh-CN.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/zh-TW.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/select2.min.js',
    I18N_PATH = '//cdnjs.cloudflare.com/ajax/libs/select2/{version}/js/i18n'.format(version=LIB_VERSION)
    JS = '//cdnjs.cloudflare.com/ajax/libs/select2/{version}/js/select2.min.js'.format(version=LIB_VERSION)
<script src="//code.jquery.com/jquery-2.1.4.min.js"></script>
commented

Hi @hartwork,

// will cause the browser to use the same scheme used by the parent page. If that is served via HTTPS, so will the asset. You can alter that behavior if you override base in your HTML head.

Anyhow, I don't see a big problem since one should server their Django site only via HTTPS and in development you always service over HTTP never file:// with runserver.

With all that being said, I will not reject a patch adding an explicit protocol. I'd welcome it :)

Best,
Joe

commented

I'm happy to create a pull request once my other pull requests #607 #608 #610 have been reviewed 🍻

commented

I'm happy to create a pull request once my other pull requests #607 #608 #610 have been reviewed 🍻

So, no pressure you say? 😉

commented

Here you go: #611