Robust UI audit: skip inline URL scan on dist/, keep structural checks

Minified JS in dist/ contains hundreds of string-constant URLs from
bundled npm libraries (React error pages, W3C namespace URIs, CDN
references, OSS credits) that are never fetched at runtime. Scanning
them produced an endless stream of false positives requiring per-URL
allowlisting.

Fix: split the A1 URL check by directory:
- src/ (our code): strict — any external URL is blocked
- dist/ (npm build output): skip inline URL scan entirely

Structural checks (A2-A6) still apply to dist/:
- External <script>/<link> loads in HTML
- Tracking/analytics identifiers
- Iframes, eval/Function, external WebSockets

Author: DeusData

scripts/security-ui.sh

@@ -36,37 +36,38 @@ else
     for UI_DIR in "${UI_DIRS[@]}"; do
         echo "Scanning: $UI_DIR"
 
-        # A1: No external domains in JS/CSS
-        echo "  Checking for external domains..."
-        if find "$UI_DIR" -type f \( -name '*.js' -o -name '*.ts' -o -name '*.tsx' -o -name '*.css' \) -exec grep -lE 'https?://' {} \; 2>/dev/null | head -20 > "$SEC_TMPDIR/urls"; then
-            while IFS= read -r file; do
-                relfile="${file#"$ROOT/"}"
-                grep -onE 'https?://[^\s"'"'"')]+' "$file" 2>/dev/null | while IFS=: read -r lineno url; do
-                    case "$url" in
-                        http://localhost*|http://127.0.0.1*|https://localhost*|https://127.0.0.1*)
-                            ;; # OK — local dev/runtime
-                        # Bundled framework URLs (embedded by npm deps in dist/ builds):
-                        http://www.w3.org/*|https://www.w3.org/*)
-                            ;; # W3C XML/SVG/MathML namespace URIs
-                        https://react.dev/*|https://reactjs.org/*)
-                            ;; # React error/docs URLs
-                        https://github.com/*|https://cdn.jsdelivr.net/*|https://cdn.j*)
-                            ;; # OSS library credits + CDN refs in bundled code
-                        https://fonts.googleapis.com/*|https://fonts.gstatic.com/*)
-                            ;; # Google Fonts (loaded by index.html)
-                        https://tailwindcss.com/*|https://tailwindc*)
-                            ;; # Tailwind CSS source annotations
-                        https://jcgt.org/*|https://doc*)
-                            ;; # Academic/documentation refs in Three.js shaders
-                        *)
-                            echo "  BLOCKED: ${relfile}:${lineno}: External URL: $url"
-                            touch "$SEC_TMPDIR/fail_flag"
-                            ;;
-                    esac
-                done
-            done < "$SEC_TMPDIR/urls"
+        # A1: No external domains in JS/CSS/TS source code.
+        # For src/ (our code): strict — any external URL is blocked.
+        # For dist/ (bundled npm output): skip inline URL scan — minified JS
+        # contains hundreds of string-constant URLs from libraries (React error
+        # pages, W3C namespace URIs, CDN references, OSS credits) that are never
+        # fetched at runtime. Scanning them is noise. Structural checks (A2-A6)
+        # still apply to dist/.
+        is_dist=false
+        [[ "$UI_DIR" == *"/dist" || "$UI_DIR" == *"/dist/" ]] && is_dist=true
+
+        if ! $is_dist; then
+            echo "  Checking for external domains (source)..."
+            if find "$UI_DIR" -type f \( -name '*.js' -o -name '*.ts' -o -name '*.tsx' -o -name '*.css' \) -exec grep -lE 'https?://' {} \; 2>/dev/null | head -20 > "$SEC_TMPDIR/urls"; then
+                while IFS= read -r file; do
+                    relfile="${file#"$ROOT/"}"
+                    grep -onE 'https?://[^\s"'"'"')]+' "$file" 2>/dev/null | while IFS=: read -r lineno url; do
+                        case "$url" in
+                            http://localhost*|http://127.0.0.1*|https://localhost*|https://127.0.0.1*)
+                                ;; # OK — local dev/runtime
+                            *)
+                                echo "  BLOCKED: ${relfile}:${lineno}: External URL: $url"
+                                touch "$SEC_TMPDIR/fail_flag"
+                                ;;
+                        esac
+                    done
+                done < "$SEC_TMPDIR/urls"
+            fi
+            [[ -f "$SEC_TMPDIR/fail_flag" ]] && FAIL=1 && rm -f "$SEC_TMPDIR/fail_flag"
+        else
+            echo "  Skipping inline URL scan for dist/ (bundled library strings)."
+            echo "  Structural checks (script loads, tracking, eval, iframes) still apply."
         fi
-        [[ -f "$SEC_TMPDIR/fail_flag" ]] && FAIL=1 && rm -f "$SEC_TMPDIR/fail_flag"
 
         # A2: No external script/link loads in HTML
         echo "  Checking for external script/link loads..."