isocpp / isocpp/CppCoreGuidelines

Move inline JavaScript into files

Open
#1,124 1 comment 0 reactions 1 assignee View on GitHub

@AndrewPardoe is already working on this.

Since Jan 22, 2018.

Dominant language
CSS
Stars
45.3k
Forks
5.6k
PR merge metrics
No merged PRs in 30d

Description

The inline JS is all pretty much loaded on $(document).ready ($(function() is a short-hand) so I see no reason why you can't move it out of the head and into files. Now why do this? It's good practice to add a Content-Security-Policy tag to mitigate XSS attacks and inline JS is an attack vector. Once the inline JS is gone, consider adding something like this:

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests;
 default-src 'self';
 script-src 'self' https://cdnjs.cloudflare.com;
 style-src 'self' fonts.googleapis.com;
 font-src 'self' fonts.googleapis.com;">

Might need refining depending on what gets blocked.

I'll avoid opening a PR for now, but you can see the commits I've made here: https://github.com/remyabel/CppCoreGuidelines/tree/gh-pages

There are some problems so far:

  • The anchor library injects inline CSS, which means we have to allow unsafe-inline, not ideal

  • Similarly there's a font being loaded in as a data: somewhere. Allowing data: is unsafe since it allows arbitrary data to be injected

Both of these effectively render CSP useless, thus I doubt this will be made into a PR. Although I'm happy to suggest workarounds if interested.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.