The-OpenROAD-Project / The-OpenROAD-Project/OpenROAD
web: Attempt to load scripts over unsafe http
Open
@jorge-ferreira-pii is already working on this.
Since Aug 5, 2026.
web
- Dominant language
- Verilog
- Stars
- 3.1k
- Forks
- 1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 136
Description
Describe the bug
When trying out the web GUI, I noticed that the interface attempts to load some JavaScript over http, which is extremely dangerous as it could be intercepted and modified by an attacker.
The source is from neilturley.dev
Which appears to be loading elk.bundled.js and netlistsvg.bundle.js
Expected Behavior
All remote resources should be loaded over https. I would actually hope that all js could be served locally so that the browser does not have to ping external resources.
Environment
Git commit: a8e52e954b743fca0cbe55759ab7bedf38caee8e
kernel: Linux 5.10.16.3-microsoft-standard-WSL2
os: Ubuntu 24.04.4 LTS (Noble Numbat)
Built with GUI bazel build
To Reproduce
- Install latest OpenROAD
- Start the web server
web_server - Open web browser and look at the network tab when loading the page
Relevant log output
Screenshots
No response
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.