From 883f1231387a511e046c56484961267e32517939 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 8 Mar 2026 17:40:15 +0000
Subject: [PATCH] fix(security): add SRI to jQuery CDN, escape chat ID, use
 server-side hostname

- Add integrity/crossorigin attributes to jQuery 3.6.0 CDN script
- Use | int filter on zammad_chat_id to prevent XSS
- Replace request.headers.get('host') with settings.external_hostname
  for canonical URL and Open Graph tags to prevent host-header injection

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/views/help.py            |  1 +
 frontend/templates/help.html | 10 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/app/views/help.py b/app/views/help.py
index eff08b1b..9f3cc8fc 100644
--- a/app/views/help.py
+++ b/app/views/help.py
@@ -33,6 +33,7 @@ async def help_center(request: Request):
         "help.html",
         {
             "request": request,
+            "external_hostname": settings.external_hostname,
             "zammad_url": settings.zammad_url,
             "zammad_chat_enabled": settings.zammad_chat_enabled,
             "zammad_chat_id": settings.zammad_chat_id,
diff --git a/frontend/templates/help.html b/frontend/templates/help.html
index b96ea5f6..03bc64d5 100644
--- a/frontend/templates/help.html
+++ b/frontend/templates/help.html
@@ -6,13 +6,13 @@
 <meta name="description" content="DocuElevate Help Center – learn how to upload, process, and route your documents automatically. Get started with sources, destinations, workflows, and integrations.">
 <meta name="keywords" content="DocuElevate, help, support, document processing, OCR, cloud storage, workflow automation, SaaS">
 <meta name="robots" content="index, follow">
-<link rel="canonical" href="https://{{ request.headers.get('host', 'app.docuelevate.com') }}/help">
+<link rel="canonical" href="https://{{ external_hostname }}/help">
 
 <!-- Open Graph -->
 <meta property="og:title" content="Help Center – DocuElevate">
 <meta property="og:description" content="Everything you need to get started with DocuElevate: upload documents, automate workflows, and connect your favourite cloud storage.">
 <meta property="og:type" content="website">
-<meta property="og:url" content="https://{{ request.headers.get('host', 'app.docuelevate.com') }}/help">
+<meta property="og:url" content="https://{{ external_hostname }}/help">
 
 <!-- Structured data (JSON-LD) for FAQ rich results -->
 <script type="application/ld+json">
@@ -479,7 +479,9 @@
 {% block scripts %}
 {% if zammad_url and zammad_form_enabled %}
 <!-- Zammad Feedback Form -->
-<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
+<script src="https://code.jquery.com/jquery-3.6.0.min.js"
+        integrity="sha384-vtXRMe3mGCbOeY7l30aIg8H9p3GdeSe4IFlP6G8JMa7o7lXvnz3GFKzPxzJdPfGK"
+        crossorigin="anonymous"></script>
 <script id="zammad_form_script" src="{{ zammad_url }}/assets/form/form.js"></script>
 <script>
 $(function() {
@@ -501,7 +503,7 @@ $(function() {
   new ZammadChat({
     fontSize: '12px',
     flat: true,
-    chatId: {{ zammad_chat_id }},
+    chatId: {{ zammad_chat_id | int }},
     title: '<strong>Chat</strong> with us!'
   });
 })();