the-other-tim-brown opened a new pull request, #877:
URL: https://github.com/apache/incubator-xtable/pull/877
## What
The 404 page loads three third-party resources that the ASF
Content-Security-Policy blocks. In production it renders with a broken
illustration placeholder and console errors.
| Resource | Line | Purpose |
|---|---|---|
| `ajax.googleapis.com/.../webfont.js` + `WebFont.load(...)` | 16-17 |
Material Icons loader |
| `fonts.googleapis.com` / `fonts.gstatic.com` preconnects | 14-15 | for the
above |
| `d3e54v103j8qbb.cloudfront.net/static/page-not-found...svg` | 24 | "page
not found" illustration |
| `d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min...js` | 29 | jQuery |
## Why it came back
#764 removed exactly these from the home page, but it did so by deleting
`static/404.html` outright. #863 then reintroduced the page at
`homepage/404.html` from the pre-#764 Webflow export, which brought the CDN
references back with it.
## Changes
Same treatment #764 gave the home page:
- **Font loader** — deleted. The 404 page has no Material Icons ligatures on
it at all (no FAQ accordions), so it was dead weight even before CSP.
- **jQuery** — repointed at `js/jquery-3.5.1.min.js`, the copy #764 already
vendored into `static/js/`.
- **Illustration** — vendored the 754-byte SVG to
`static/images/page-not-found.svg`. Keeping it as a file rather than inlining
it means no layout change, no new CSS, and no inline `style` attribute. RAT
excludes `**/website/**` and `Github.svg` / `linkedin.svg` / `twitter.svg`
already ship without headers, so this matches existing practice.
The page now loads entirely from the site's own origin — the only remaining
`http` string in the file is the Webflow attribution comment on line 1.
## Testing
`npm run build && npm run serve`, then requested a nonexistent path:
- the Webflow "Page Not Found" page renders, now referencing
`page-not-found.svg` with no `cloudfront` references in the output
- every asset the page references resolves locally: `css/normalize.css`,
`css/webflow.css`, `css/onetable-ad267e.webflow.css`,
`images/xtable-favicon.png`, `images/page-not-found.svg`,
`js/jquery-3.5.1.min.js`, `js/webflow.js`
- home page output unchanged
## Note, not fixed here
Both `homepage/404.html:16` and `homepage/index.html:23` reference
`images/webclip.png` as their `apple-touch-icon`, but that file was deleted in
62ca0c0 ("removed unused images"). It 404s on both pages. Not a CSP issue and
it affects the home page equally, so it seemed better left to its own change.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01CyVF3fyK2VQE7DPd31mRLv
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
