Parents and children of check-in [ce8dcd1ae6]
|
2026-08-31
| ||
| 20:33 | pin the nonce alphabet: a + in the attribute silently kills CSP mode check-in: 47064a1033 user: quarry tags: trunk | |
| 20:30 | url-safe nonce: no + to escape in the attribute check-in: ce8dcd1ae6 user: quarry tags: trunk | |
| 20:02 |
a strict CSP: nonces, no unsafe-eval, no inline handlers
quarry served no page policy at all. The blocker was never the data-on:* attributes — script-src does not govern data attributes — it was unsafe-eval, because datastar compiled expressions with Function(). 1.0.3 takes a nonce instead. Removed all 14 inline handlers: 11 identical onchange=this.form.submit() became data-on:change with requestSubmit (which validates, unlike submit), two selection handlers became expressions, and the copy-hash button moved to a delegated assets/copy.js. Scripts now carry content-hashed immutable URLs instead of revalidating daily. The audit found the expressions already safe, for a reason worth pinning: html/template strips a data- prefix before classifying, so data-on:drop gets the JAVASCRIPT escaper. That matters because an HTML-escaped quote decodes back to a quote before any script reads the attribute, and a board column status comes from .quarry/tickets.json — upstream content on a mirror. check-in: ef352402f6 user: quarry tags: trunk | |