fix(css): remove dead main:has(.book-show) max-width + fix reader comment (bookshelf-sgv1d) #1234

Merged

zombor merged 1 commit from bd-bookshelf-sgv1d into main 2026-07-25 01:45:39 +00:00

Conversation 3 Commits 1 Files changed 1 +1 -6

zombor commented 2026-07-25 00:05:08 +00:00

Owner

Copy link

Summary

Remove dead CSS rule and fix stale documentation:

• Deleted the dead main:has(.book-show){max-width:none} rule (line 3101-3105) since main no longer has a global max-width
• Fixed the stale comment at line 403 that incorrectly attributed the reader width constraint to .reader-column when it's actually .reader-viewer{max-width:700px}

This is a pure cleanup with no visual impact.

Closes bead bookshelf-sgv1d on merge.

## Summary Remove dead CSS rule and fix stale documentation: - Deleted the dead `main:has(.book-show){max-width:none}` rule (line 3101-3105) since main no longer has a global max-width - Fixed the stale comment at line 403 that incorrectly attributed the reader width constraint to `.reader-column` when it's actually `.reader-viewer{max-width:700px}` This is a pure cleanup with no visual impact. Closes bead bookshelf-sgv1d on merge.

zombor added 1 commit 2026-07-25 00:05:09 +00:00

fix(css): remove dead main:has(.book-show) max-width rule and fix reader comment ... e8760a2fca

The main:has(.book-show) max-width rule is a no-op since main no longer has a
global max-width. Remove dead CSS and fix the stale comment that incorrectly
attributed the reader width constraint to .reader-column; it's actually
.reader-viewer{max-width:700px}.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

zombor commented 2026-07-25 00:34:16 +00:00

Author

Owner

Copy link

Security Review — PR #1238 (mysql driver log → slog)

Adversarial focus: credential leakage via the driver logger, log injection/forging, global SetLogger abuse, new boundaries.

(1) Secret leakage — CLEAR. Audited every call site that reaches the driver's Logger.Print in go-sql-driver/mysql v1.9.3: connection.go:64 (mc.log), connector.go:119/148, packets.go:58/68/86/100/155, auth.go:341, connection.go:189/214/706. All emit error strings, auth-plugin names, or sequence numbers. cfg.Passwd is referenced only in auth.go (scramble) and dsn.go:262 (FormatDSN) — neither reaches the logger, and the DSN itself is never passed to Print. So this path cannot surface credentials and does not bypass maskDSN (the DSN never enters it).

(2) Log injection / forging — CLEAR. The driver message is passed to logger.Warn(msg). slog handlers escape the msg field (JSONHandler JSON-escapes newlines/quotes; TextHandler quotes on special chars), so an embedded newline cannot forge a fake log record. Driver messages are driver-internal, not app-user input; the only externally-influenced content (a server-returned error string) presupposes a trusted-DB compromise and is escaped regardless.

(3) Global SetLogger side-effect — CLEAR. installDriverLogger sets the driver's package logger to the app's own *slog.Logger (last-caller-wins, documented). No external input controls the installed logger; not abusable.

(4) New inputs/boundaries — none. No new request surface, no user-supplied data, no multi-user-scoping surface.

No findings.

REVIEW VERDICT: 0 blocker, 0 major, 0 minor

## Security Review — PR #1238 (mysql driver log → slog) Adversarial focus: credential leakage via the driver logger, log injection/forging, global `SetLogger` abuse, new boundaries. **(1) Secret leakage — CLEAR.** Audited every call site that reaches the driver's `Logger.Print` in go-sql-driver/mysql v1.9.3: `connection.go:64` (`mc.log`), `connector.go:119`/`148`, `packets.go:58/68/86/100/155`, `auth.go:341`, `connection.go:189/214/706`. All emit error strings, auth-plugin names, or sequence numbers. `cfg.Passwd` is referenced only in `auth.go` (scramble) and `dsn.go:262` (`FormatDSN`) — neither reaches the logger, and the DSN itself is never passed to `Print`. So this path cannot surface credentials and does not bypass `maskDSN` (the DSN never enters it). **(2) Log injection / forging — CLEAR.** The driver message is passed to `logger.Warn(msg)`. slog handlers escape the `msg` field (JSONHandler JSON-escapes newlines/quotes; TextHandler quotes on special chars), so an embedded newline cannot forge a fake log record. Driver messages are driver-internal, not app-user input; the only externally-influenced content (a server-returned error string) presupposes a trusted-DB compromise and is escaped regardless. **(3) Global `SetLogger` side-effect — CLEAR.** `installDriverLogger` sets the driver's package logger to the app's own `*slog.Logger` (last-caller-wins, documented). No external input controls the installed logger; not abusable. **(4) New inputs/boundaries — none.** No new request surface, no user-supplied data, no multi-user-scoping surface. No findings. REVIEW VERDICT: 0 blocker, 0 major, 0 minor

zombor commented 2026-07-25 00:34:39 +00:00

Author

Owner

Copy link

[MINOR] static/css/main.css — commit message accuracy

The commit message describes the removed main:has(.book-show) rule as "dead CSS" and the selector as "dead", but this is inaccurate. The .book-show selector IS rendered in the template (templates/pages/books_show.html:32), making it an active selector. The rule itself is correctly identified as a no-op/inert (the main element never has a max-width property set anywhere), but describing an active selector as "dead" conflates two separate concepts. The CSS comment already documented this as "no-op — kept as explicit documentation of the intent," so the characterization should be "removing inert rule" rather than "removing dead selector."

The actual changes are correct and safe:

• Comment fix: .reader-column → .reader-viewer is accurate (verified: .reader-viewer has max-width: 700px, .reader-column does not)
• Rule removal: Safe, no visual impact

---

REVIEW VERDICT: 0 blocker, 0 major, 1 minor

[MINOR] static/css/main.css — commit message accuracy The commit message describes the removed `main:has(.book-show)` rule as "dead CSS" and the selector as "dead", but this is inaccurate. The `.book-show` selector IS rendered in the template (`templates/pages/books_show.html:32`), making it an active selector. The rule itself is correctly identified as a no-op/inert (the `main` element never has a `max-width` property set anywhere), but describing an active selector as "dead" conflates two separate concepts. The CSS comment already documented this as "no-op — kept as explicit documentation of the intent," so the characterization should be "removing inert rule" rather than "removing dead selector." The actual changes are correct and safe: - Comment fix: `.reader-column` → `.reader-viewer` is accurate (verified: `.reader-viewer` has `max-width: 700px`, `.reader-column` does not) - Rule removal: Safe, no visual impact --- REVIEW VERDICT: 0 blocker, 0 major, 1 minor

zombor commented 2026-07-25 00:34:42 +00:00

Author

Owner

Copy link

Security Review — PR #1234

Reviewed the diff (removes an inert main:has(.book-show){max-width:none} rule + corrects a stale CSS comment in static/css/main.css).

Verification performed:

• Confirmed the removed rule is a true no-op — no max-width is set on main anywhere else in main.css, and max-width:none is the CSS initial value, so removal changes nothing rendered.
• Confirmed max-width is a pure layout property — not contain, overflow, visibility, clip, or any containment/isolation control. No security-relevant affordance is dropped.
• No CSP / inline-style surface touched (stylesheet file only; no inline styles introduced).
• Comment fix is factually accurate: .reader-viewer carries max-width:700px; the previously-named .reader-column has no max-width (flex:1). The corrected reference points at the element that actually constrains width.
• No secrets/PII, no auth/scoping, no injection/SSRF, no fan-out surface — cosmetic CSS-only change.

No findings.

REVIEW VERDICT: 0 blocker, 0 major, 0 minor

## Security Review — PR #1234 Reviewed the diff (removes an inert `main:has(.book-show){max-width:none}` rule + corrects a stale CSS comment in `static/css/main.css`). **Verification performed:** - Confirmed the removed rule is a true no-op — no `max-width` is set on `main` anywhere else in `main.css`, and `max-width:none` is the CSS initial value, so removal changes nothing rendered. - Confirmed `max-width` is a pure layout property — not `contain`, `overflow`, visibility, `clip`, or any containment/isolation control. No security-relevant affordance is dropped. - No CSP / inline-style surface touched (stylesheet file only; no inline styles introduced). - Comment fix is factually accurate: `.reader-viewer` carries `max-width:700px`; the previously-named `.reader-column` has no max-width (`flex:1`). The corrected reference points at the element that actually constrains width. - No secrets/PII, no auth/scoping, no injection/SSRF, no fan-out surface — cosmetic CSS-only change. No findings. REVIEW VERDICT: 0 blocker, 0 major, 0 minor

zombor force-pushed bd-bookshelf-sgv1d from e8760a2fca to f1603ce0b2 2026-07-25 01:27:56 +00:00 Compare

zombor merged commit 58a1e49626 into main 2026-07-25 01:45:39 +00:00

zombor referenced this pull request from a commit 2026-07-25 01:45:42 +00:00

Merge pull request 'fix(css): remove dead main:has(.book-show) max-width + fix reader comment (bookshelf-sgv1d)' (#1234) from bd-bookshelf-sgv1d into main

zombor referenced this pull request 2026-07-25 01:52:56 +00:00

feat(bulk): scan-file by-filter + library kebab menu with count confirmation [shot:library-scan-file-screenshot] (bookshelf-cs2zl.2) #1239

zombor referenced this pull request 2026-07-26 21:59:47 +00:00

fix(middleware): exempt PUT /books/{id}/content from 1MB MaxBytes cap (bookshelf-t582g.4.3) #1246

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

zombor/pergamum!1234

No description provided.