From 81e488cbfdb14c1d4318957e152d36271d7da6dc Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
<161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 02:32:42 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Enforce=20s?=
=?UTF-8?q?trict=20CSP=20script-src?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Extracted the inline theme initialization script into a separate file to remove `unsafe-inline` from the Content-Security-Policy `script-src` directive. This strongly mitigates XSS risks.
Co-authored-by: AstroMyth101 <75667958+AstroMyth101@users.noreply.github.com>
---
src/_includes/base.njk | 20 ++------------------
src/assets/js/theme-init.js | 15 +++++++++++++++
2 files changed, 17 insertions(+), 18 deletions(-)
create mode 100644 src/assets/js/theme-init.js
diff --git a/src/_includes/base.njk b/src/_includes/base.njk
index b0686fa..e2e5085 100644
--- a/src/_includes/base.njk
+++ b/src/_includes/base.njk
@@ -3,24 +3,8 @@
-
-
+
+
{{ title or site.title }}
diff --git a/src/assets/js/theme-init.js b/src/assets/js/theme-init.js
new file mode 100644
index 0000000..b2565bc
--- /dev/null
+++ b/src/assets/js/theme-init.js
@@ -0,0 +1,15 @@
+/* Set theme before paint to avoid a flash: saved choice, else system preference.
+ Also emit a matching theme-color meta so the mobile browser chrome matches. */
+(function () {
+ document.documentElement.classList.add('js');
+ var theme = 'dark';
+ try {
+ var saved = localStorage.getItem('theme');
+ theme = saved || (window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
+ } catch (e) {}
+ document.documentElement.dataset.theme = theme;
+ var meta = document.createElement('meta');
+ meta.name = 'theme-color';
+ meta.content = theme === 'light' ? '#eef2f8' : '#070d19';
+ document.head.appendChild(meta);
+})();