Summary
The production homepage (index.html) ships a debug error overlay: global error and unhandledrejection listeners paint a fixed red/orange banner across the top of the page containing the raw JS error message, filename, and line number whenever any client-side script throws. This was clearly intended for debugging, but it runs in production for every visitor and exposes internal script/implementation details.
Evidence
src/templates/index.html:11-38:
<script>
window.addEventListener('error', function(e) {
var errDiv = document.createElement('div');
errDiv.style.position = 'fixed';
...
errDiv.style.background = 'red';
...
errDiv.textContent = 'JS ERROR: ' + e.message + ' at ' + e.filename + ':' + e.lineno;
document.body.appendChild(errDiv);
});
window.addEventListener('unhandledrejection', function(e) {
var errDiv = document.createElement('div');
...
errDiv.style.background = 'orange';
...
errDiv.textContent = 'PROMISE REJECTION: ' + (e.reason ? e.reason.message : e.reason);
document.body.appendChild(errDiv);
});
</script>These listeners are in the <head> and execute for every visitor. Any JS error (many are transient — race conditions, third-party failures, etc.) paints a full-width banner that persists and obscures the site.
Impact
- Poor UX: a random transient JS error permanently covers the top of the page with an intrusive banner for end users.
- Information disclosure:
e.filename, e.lineno, and exception messages leak internal script paths and logic details to the public.
- No dismissal mechanism; the banner stays until reload.
Suggested Fix
- Remove the overlay from production. If a debug aid is wanted, gate it behind a dev-only flag (e.g.,
FLASK_DEBUG/build-time constant) or a localStorage opt-in such as localStorage.getItem('devpath.debug').
- At minimum, only log to console (
console.error) instead of mutating the DOM, and never render raw messages to the page.
Summary
The production homepage (
index.html) ships a debug error overlay: globalerrorandunhandledrejectionlisteners paint a fixed red/orange banner across the top of the page containing the raw JS error message, filename, and line number whenever any client-side script throws. This was clearly intended for debugging, but it runs in production for every visitor and exposes internal script/implementation details.Evidence
src/templates/index.html:11-38:These listeners are in the
<head>and execute for every visitor. Any JS error (many are transient — race conditions, third-party failures, etc.) paints a full-width banner that persists and obscures the site.Impact
e.filename,e.lineno, and exception messages leak internal script paths and logic details to the public.Suggested Fix
FLASK_DEBUG/build-time constant) or a localStorage opt-in such aslocalStorage.getItem('devpath.debug').console.error) instead of mutating the DOM, and never render raw messages to the page.