fix: safeImg allow same-origin /img/ proxy urls (vendor-neutral image proxy 2026-06-03) — product cards were falling back to hero-bg (images all wrong)

4c05158d0f3392f09ca7c3be667da7d2b0b0cf59 · 2026-06-18 09:04:25 -0700 · Steve Abrams

Files touched

M public/index.html

Diff

commit 4c05158d0f3392f09ca7c3be667da7d2b0b0cf59
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jun 18 09:04:25 2026 -0700

    fix: safeImg allow same-origin /img/ proxy urls (vendor-neutral image proxy 2026-06-03) — product cards were falling back to hero-bg (images all wrong)
---
 public/index.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/public/index.html b/public/index.html
index 8e0691b..bbe3115 100644
--- a/public/index.html
+++ b/public/index.html
@@ -628,8 +628,10 @@ function cleanSku(s){
   var V=/(?:^|-)(versace|kravet|fentucci|sandberg|harlequin|blithfield|westport|thibaut|koroseal|schumacher|scalamandre|fromental|dedar|carnegie|marburg|fabricut|coordonne|nina-campbell|lee-jofa(?:-modern)?|clarke(?:-and)?-clarke|clarke|brunschwig(?:-and)?(?:-fils)?|designers-guild|graham-(?:and-)?brown|andrew-martin|candice-olson|ronald-redding|jeffrey-stevens|sister-parish|arte-international|wolf-gordon|phillip-jeffries|cole-(?:and-)?son|maya-romanoff|g-p-j-baker|les-ensembliers|breegan(?:-jane)?)(?:-\\d+)?(?=-|$)/gi;
   return String(s||'').replace(V,'').replace(/--+/g,'-').replace(/^-+|-+$/g,'');
 }
-// Image-URL allowlist: only DW Shopify CDN + designerwallcoverings.com (defends against XSS via crafted products.json)
-function safeImg(u) { return /^https:\/\/(?:cdn\.shopify\.com|designerwallcoverings\.com)\//.test(u || '') ? u : '/hero-bg.jpg'; }
+// Image-URL allowlist: same-origin proxied /img/ (vendor-neutral image proxy, 2026-06-03) +
+// DW Shopify CDN + designerwallcoverings.com (defends against XSS via crafted products.json).
+// /img/ is server-controlled same-origin (not protocol-relative, not a javascript: URI) so it's safe.
+function safeImg(u) { u = u || ''; return (/^\/img\//.test(u) || /^https:\/\/(?:cdn\.shopify\.com|designerwallcoverings\.com)\//.test(u)) ? u : '/hero-bg.jpg'; }
 // Trade-spec helpers — derive MOQ / width / repeat / NET30 trade $ from product fields when available,
 // fall back to "Spec sheet on request" so the card never looks DTC.
 function tradeSpec(p) {

← 2e367c7 ffepurchasing: rails fire again — wire sliders + grid filter · back to Ffepurchasing · Mount new-arrivals promo strip (Tier B): require ../_shared/ a2c5b59 →