Skip to content

Commit d67f9b4

Browse files
Copilotbenfoxall
Copilot
and
benfoxall
committed
Security hardening: CSP, referrer policy, inline script extraction, Bunny Fonts, iframe sandbox
Co-authored-by: benfoxall <51385+benfoxall@users.noreply.github.com>
1 parent 4f334fd commit d67f9b4

6 files changed

Lines changed: 26 additions & 33 deletions

File tree

‎_layouts/default.html‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,10 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
7+
<meta name="referrer" content="strict-origin-when-cross-origin">
8+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' https://fonts.bunny.net; font-src https://fonts.bunny.net; img-src 'self' data:; frame-src https://open.spotify.com; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'">
79

8-
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600&family=Space+Mono:wght@400&display=swap"
10+
<link href="https://fonts.bunny.net/css2?family=Inter:wght@400;600&family=Space+Mono:wght@400&display=swap"
911
rel="stylesheet">
1012
<link rel="stylesheet" href="/assets/style.css">
1113

@@ -63,9 +65,8 @@
6365
{% endunless %}
6466
</nav>
6567

66-
<script>
67-
for (const a of document.querySelectorAll('.🗺 a')) if (location.href === a.href) a.classList.add('current')
68-
</script>
68+
<script src="/assets/nav-current.js" defer></script>
69+
<script src="/assets/local-time.js" defer></script>
6970

7071

7172
{% if page.show_header %}
@@ -90,10 +91,10 @@ <h1 class="⭐️">
9091
<footer>
9192
<ul class="🔗">
9293
<li>
93-
Header image – <a href="https://back7.co/home/raspberry-pi-recovery-kit">The Raspberry Pi Recovery Kit</a>
94+
Header image – <a href="https://back7.co/home/raspberry-pi-recovery-kit" rel="noopener noreferrer">The Raspberry Pi Recovery Kit</a>
9495
</li>
9596
<li>
96-
Site hosted with <a href="https://github.com">Github</a>. {% if site.github %}View the <a href="{{ site.github.repository_url }}">source repository</a>.{% endif %}
97+
Site hosted with <a href="https://github.com" rel="noopener noreferrer">Github</a>. {% if site.github %}View the <a href="{{ site.github.repository_url }}" rel="noopener noreferrer">source repository</a>.{% endif %}
9798
</li>
9899
</ul>
99100
</footer>

‎_layouts/hack.html‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,7 @@ <h1>
1111
{% if pagesize < 2 %}
1212
{%- capture content -%}
1313
{% assign start_time = page.date | slice:0,10 | append:"T08:30Z" %}
14-
This hack is happening on <time style="font-weight: bold;" datetime="{{start_time}}">{{ start_time| date_to_long_string }}<span>
15-
<script>
16-
document.currentScript.replaceWith(
17-
document.createTextNode(
18-
new Intl.DateTimeFormat('default', {
19-
hour: 'numeric',
20-
minute: 'numeric',
21-
timeZoneName: 'long'
22-
})
23-
.format(new Date("{{start_time}}"))
24-
)
25-
)
26-
</script>
14+
This hack is happening on <time style="font-weight: bold;" datetime="{{start_time}}">{{ start_time| date_to_long_string }}<span class="local-time">
2715
<noscript>
2816
{{ start_time | date: "%k:%M%P %Z" }}
2917
</noscript>

‎assets/local-time.js‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
document.querySelectorAll('time[datetime] .local-time').forEach(function (span) {
2+
var timeEl = span.closest('time[datetime]');
3+
if (!timeEl) return;
4+
var dt = timeEl.getAttribute('datetime');
5+
if (!dt) return;
6+
try {
7+
span.textContent = new Intl.DateTimeFormat('default', {
8+
hour: 'numeric',
9+
minute: 'numeric',
10+
timeZoneName: 'long'
11+
}).format(new Date(dt));
12+
} catch (e) {}
13+
});

‎assets/nav-current.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
for (const a of document.querySelectorAll('.🗺 a')) {
2+
if (location.href === a.href) a.classList.add('current');
3+
}

‎pages/index.html‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,7 @@ <h2>Next event</h2>
1919
<time class="⏰" datetime="{{start_time}}">
2020
{{ start_time | date_to_long_string }}
2121

22-
<span>
23-
<script>
24-
document.currentScript.replaceWith(
25-
document.createTextNode(
26-
new Intl.DateTimeFormat('default', {
27-
hour: 'numeric',
28-
minute: 'numeric',
29-
timeZoneName: 'long'
30-
})
31-
.format(new Date("{{start_time}}"))
32-
)
33-
)
34-
</script>
22+
<span class="local-time">
3523
<noscript>
3624
{{ start_time | date: "%k:%M%P %Z" }}
3725
</noscript>

‎pages/podcast.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,4 @@ _Or_, subscribe on Spotify:
2727

2828
You can hear the latest published episode here:
2929

30-
<iframe src="https://open.spotify.com/embed-podcast/show/2ppoyoTxxSv9IvRGGqLWP7" width="100%" height="232" frameborder="0" allowtransparency="true" allow="encrypted-media" title="Spotify Podcast player - Airquotes the Podcast Airquotes"></iframe>
30+
<iframe src="https://open.spotify.com/embed-podcast/show/2ppoyoTxxSv9IvRGGqLWP7" width="100%" height="232" frameborder="0" allowtransparency="true" allow="encrypted-media" title="Spotify Podcast player - Airquotes the Podcast Airquotes" sandbox="allow-scripts allow-same-origin allow-presentation"></iframe>

0 commit comments

Comments
 (0)