fix: safeImg allow same-origin /img/ proxy urls (vendor-neutral image proxy 2026-06-03) — product cards were falling back to hero-bg (images all wrong)

1e3ff1dc0284ef702257827b737284edfcdd942b · 2026-06-18 09:04:28 -0700 · Steve Abrams

Files touched

M public/index.html

Diff

commit 1e3ff1dc0284ef702257827b737284edfcdd942b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jun 18 09:04:28 2026 -0700

    fix: safeImg allow same-origin /img/ proxy urls (vendor-neutral image proxy 2026-06-03) — product cards were falling back to hero-bg (images all wrong)
---
 public/index.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/public/index.html b/public/index.html
index 6003a9d..953b952 100644
--- a/public/index.html
+++ b/public/index.html
@@ -666,8 +666,10 @@ const HOSTKEY = location.hostname.replace(/\./g, '_');
 const LABELS = {"all":"All","texture":"Natural Raffia Weave","botanical":"Botanical & Leaf","palm":"Palm & Tropical"};
 
 function escAttr(s) { return String(s == null ? '' : s).replace(/[&<>"']/g, c => ({ '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;' }[c])); }
-// Image-URL allowlist: only DW Shopify CDN + designerwallcoverings.com (defends against XSS via crafted products.json)
-function safeImg(u) { return /^https:\/\/(?:cdn\.shopify\.com|designerwallcoverings\.com)\//.test(u || '') ? u : '/hero-bg.jpg'; }
+// Image-URL allowlist: same-origin proxied /img/ (vendor-neutral image proxy, 2026-06-03) +
+// DW Shopify CDN + designerwallcoverings.com (defends against XSS via crafted products.json).
+// /img/ is server-controlled same-origin (not protocol-relative, not a javascript: URI) so it's safe.
+function safeImg(u) { u = u || ''; return (/^\/img\//.test(u) || /^https:\/\/(?:cdn\.shopify\.com|designerwallcoverings\.com)\//.test(u)) ? u : '/hero-bg.jpg'; }
 function cardHTML(p) {
   const eager = state.page === 1;
   return '<img loading="' + (eager ? 'eager' : 'lazy') + '"' + (eager ? ' fetchpriority="high"' : '') + ' src="' + escAttr(safeImg(p.image_url)) + '" alt="' + escAttr(p.title) + '">'

← c362dca raffiawalls: rails fire again — wire sliders + grid filter t · back to Raffiawalls · Mount new-arrivals promo strip (Tier B): require ../_shared/ bd90e7c →