- Shipped
- 20 Agosti 2026, 22:11 UTC
- Author
- kamo
- Commit
- e916414
The visitor drawer painted a broken-image glyph where each country flag should be. react-country-flag's `svg` mode reads like a self-contained component and is actually an <img> pointed at cdn.jsdelivr.net, and this app is served under img-src 'self' data: blob: https://theme.kamocrm.com https://*.kamocrm.com so the browser refuses the request before it is made. Nothing throws, nothing is logged, no test fails — the only symptom is the missing picture. Swapping CDNs would not have fixed it: flagcdn.com, which several older screens still use, is blocked by the same policy and is a third-party leak besides — it tells a stranger every visitor's country on every render. The NavTop language picker already had the right answer and has had it all along: countryFlagEmoji() renders a Unicode flag, which is text. Nothing is fetched, so nothing can be blocked, and nothing leaves the tenant. FlagBadge now does the same, including LanguageSelector's emoji font stack — without it Windows falls back to a font with no flag glyphs and renders the letters "US" instead of a flag. check-csp-image-hosts.mjs makes the rule enforceable and runs in npm test. It found one more live offender while being written — LeadViewClient's country and language flags, broken the same way. That and seven other files are listed as known offenders rather than quietly swept in: US STATE flags have no Unicode emoji, so they need a real decision (self-host the sprite, or drop the flag) instead of a mechanical substitution. The list may only ever shrink.