feat(html): enforce offline report CSP

[nia-sg-bot]

Summary

• add a restrictive Content Security Policy to canonical standalone HTML reports
• keep the report self-contained while allowing only its inline stylesheet and data URLs
• cover the policy in the canonical HTML formatter contract test

Part of #20

Validation

• python3 -m pytest tests/test_html_formatter.py -q
• python3 -m pytest -q
• git diff --check

Summary by CodeRabbit

• Security

  • Generated HTML reports now include a strict Content Security Policy to limit permitted content sources, inline styles, images, base URLs, and form actions.

• Tests

  • Added coverage verifying that rendered HTML reports contain the expected Content Security Policy.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9639b9af-43ec-445b-9d78-a3ab2029e32d

📥 Commits

Reviewing files that changed from the base of the PR and between 1bafda5 and 4993ab8.

📒 Files selected for processing (2)

• diffgraph/formatters/html.py
• tests/test_html_formatter.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The HTML formatter now emits a Content-Security-Policy meta tag. The test verifies restrictions for default sources, inline styles, data images, base URIs, and form actions.

Changes

HTML Content Security Policy

Layer / File(s)	Summary
Add and verify CSP metadata diffgraph/formatters/html.py, tests/test_html_formatter.py	The generated HTML head includes a Content-Security-Policy meta tag. The test verifies default-src 'none', style-src 'unsafe-inline', img-src data:, base-uri 'none', and form-action 'none'.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 4993a

The report now emits the intended restrictive CSP, and the change is ready to merge after normal validation.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: enforcing a restrictive Content Security Policy for offline HTML reports.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nia/issue-20-offline-html-csp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nia-sg-bot]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.