isocpp / isocpp/CppCoreGuidelines
Move inline JavaScript into files
@AndrewPardoe is already working on this.
Since Jan 22, 2018.
- Dominant language
- CSS
- Stars
- 45.3k
- Forks
- 5.6k
- PR merge metrics
- No merged PRs in 30d
Description
The inline JS is all pretty much loaded on $(document).ready ($(function() is a short-hand) so I see no reason why you can't move it out of the head and into files. Now why do this? It's good practice to add a Content-Security-Policy tag to mitigate XSS attacks and inline JS is an attack vector. Once the inline JS is gone, consider adding something like this:
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests;
default-src 'self';
script-src 'self' https://cdnjs.cloudflare.com;
style-src 'self' fonts.googleapis.com;
font-src 'self' fonts.googleapis.com;">
Might need refining depending on what gets blocked.
I'll avoid opening a PR for now, but you can see the commits I've made here: https://github.com/remyabel/CppCoreGuidelines/tree/gh-pages
There are some problems so far:
-
The anchor library injects inline CSS, which means we have to allow
unsafe-inline, not ideal -
Similarly there's a font being loaded in as a
data:somewhere. Allowingdata:is unsafe since it allows arbitrary data to be injected
Both of these effectively render CSP useless, thus I doubt this will be made into a PR. Although I'm happy to suggest workarounds if interested.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.