Security: Unrestricted External CDN Script Loading

[tomaioo]

Summary

Security: Unrestricted External CDN Script Loading

Problem

Severity: Medium | File: frontends/ui/src/app/layout.tsx:L48

The root layout injects a script tag directly from https://unpkg.com/external-svg-loader@1.6.8/svg-loader.min.js. If the CDN is compromised or the package is tampered with, arbitrary malicious JavaScript will be executed in the context of the user's browser (Supply Chain Attack / Cross-Site Scripting).

Solution

Use Subresource Integrity (SRI) hashes for the external script tag or vendor the script locally to eliminate the external dependency.

Changes

• frontends/ui/src/app/layout.tsx (modified)

Summary by CodeRabbit

• Bug Fixes
  • Updated SVG icon loading to use a locally hosted script, improving reliability and reducing reliance on external services.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Walkthrough

The root layout’s SVG loader script source changed from an external CDN URL to the local /svg-loader.min.js path, with the accompanying comment updated.

Changes

SVG loader configuration

Layer / File(s)	Summary
Local SVG loader wiring frontends/ui/src/app/layout.tsx	The root layout head now loads the SVG loader from /svg-loader.min.js instead of the CDN URL.

Estimated code review effort: 1 (Trivial) | ~2 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Title check	❌ Error	The title is relevant, but it does not use the required Conventional Commits format.	Rename it to a Conventional Commit like fix(layout): load svg loader locally and keep it under 72 characters.
Description check	⚠️ Warning	The description explains the issue and fix, but it is missing most required template sections, including DCO, validation, reviewers, and related issues.	Add the template sections: Overview, DCO sign-off, Validation checklist, reviewers start point, and any related issue links.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontends/ui/src/app/layout.tsx`:
- Around line 53-55: Ensure the SVG loader referenced by the layout script is
available at the configured /svg-loader.min.js path by vendoring the asset under
the UI public directory, or replace the local source with the existing CDN
source. Preserve the SVG loader initialization in the layout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 38641378-270f-4a72-832d-6698e09f6448

📥 Commits

Reviewing files that changed from the base of the PR and between d336279 and 893c96a.

📒 Files selected for processing (1)

• frontends/ui/src/app/layout.tsx

📜 Review details

🧰 Additional context used

📓 Path-based instructions (3)

frontends/ui/**/*.{js,ts,jsx,tsx,vue}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Run npm lint, type-check, and build validation for UI changes in frontends/ui

Files:

• frontends/ui/src/app/layout.tsx

frontends/ui/**/*.{ts,tsx,jsx,js}

📄 CodeRabbit inference engine (AGENTS.md)

frontends/ui/**/*.{ts,tsx,jsx,js}: The UI is built with Next.js / React / TypeScript / Tailwind with KUI components; reuse existing KUI components and visual patterns rather than introducing new ones
Validate UI-affecting changes with npm run lint, npm run type-check, and npm run test:ci, and include a screenshot for visible changes

Files:

• frontends/ui/src/app/layout.tsx

frontends/ui/**/*

⚙️ CodeRabbit configuration file

frontends/ui/**/*: Review UI changes for strict TypeScript behavior, API contract alignment, auth/session handling, accessible controls,
resilient loading and error states, and report/chat state consistency. Prefer existing UI patterns and require tests
for changed user-visible workflows.

Files:

• frontends/ui/src/app/layout.tsx

[coderabbitai]

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

fd -H -t f 'svg-loader\.min\.js$' frontends/ui
cd frontends/ui
npm run lint
npm run type-check
npm run test:ci
npm run build

Repository: NVIDIA-AI-Blueprints/aiq

Length of output: 400

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n-- layout.tsx excerpt --\n'
sed -n '1,120p' frontends/ui/src/app/layout.tsx

printf '\n-- candidate loader files --\n'
fd -a -H -t f 'svg-loader.*\.js$' frontends/ui || true

printf '\n-- public assets matching svg-loader --\n'
fd -a -H -t f 'svg-loader' frontends/ui/public frontends/ui/src frontends/ui || true

printf '\n-- references to svg-loader.min.js --\n'
rg -n --hidden --glob '!node_modules' 'svg-loader\.min\.js|svg-loader' frontends/ui

printf '\n-- next config and public root clues --\n'
git ls-files frontends/ui | rg '^(frontends/ui/(public/|next\.config|src/app/layout\.tsx|package\.json))'

Repository: NVIDIA-AI-Blueprints/aiq

Length of output: 3378

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,120p' frontends/ui/src/app/layout.tsx
fd -a -H -t f 'svg-loader.*\.js$' frontends/ui || true
rg -n --hidden --glob '!node_modules' 'svg-loader\.min\.js|svg-loader' frontends/ui || true
git ls-files frontends/ui | rg '^(frontends/ui/(public/|next\.config|src/app/layout\.tsx|package\.json))' || true

Repository: NVIDIA-AI-Blueprints/aiq

Length of output: 3126

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '-- files named svg-loader.min.js --'
fd -a -H -t f 'svg-loader\.min\.js$' .

printf '\n%s\n' '-- references to svg-loader.min.js --'
rg -n --hidden --glob '!node_modules' 'svg-loader\.min\.js|svg-loader' frontends/ui || true

printf '\n%s\n' '-- layout.tsx lines 45-65 --'
sed -n '45,65p' frontends/ui/src/app/layout.tsx

Repository: NVIDIA-AI-Blueprints/aiq

Length of output: 1662

---

Ship the SVG loader with the UI The app now points at /svg-loader.min.js, but there’s no vendored file under frontends/ui/public, so the script will 404 and svg[data-src] icons won’t inline. Either commit the asset there or keep the CDN source.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontends/ui/src/app/layout.tsx` around lines 53 - 55, Ensure the SVG loader
referenced by the layout script is available at the configured
/svg-loader.min.js path by vendoring the asset under the UI public directory, or
replace the local source with the existing CDN source. Preserve the SVG loader
initialization in the layout.

Sources: Coding guidelines, Path instructions