Skip to content

Commit 4fe7258

Browse files
AntikodeAntikode
Antikode
authored and
Antikode
committed
Add Content-Security-Policy meta tag as defense-in-depth across all 40 pages
Restricts script/style/connect/img/font/object/base-uri/form-action to 'self' plus the two external origins actually used (api.counterapi.dev for the visit counter, formsubmit.co for the waitlist form). script-src and style-src need 'unsafe-inline' because of inline JSON-LD blocks and a couple of inline style= attributes, but connect-src and img-src are tightly scoped — this blocks exfiltration to arbitrary domains and loading of remote scripts even though it can't block inline script execution itself.
1 parent 8848212 commit 4fe7258

40 files changed

Lines changed: 40 additions & 0 deletions

‎404.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Page not found — ClientPDF</title>
78
<meta name="description" content="This page doesn't exist. Find the PDF tool you're looking for from ClientPDF's full tool list." />
89
<meta name="robots" content="noindex" />

‎bookmarks.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Add bookmarks to a PDF without uploading it — ClientPDF</title>
78
<meta name="description" content="Add named bookmarks to a PDF that jump straight to a page in any reader's sidebar — entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/bookmarks.html" />

‎border.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Add page borders to a PDF without uploading it — ClientPDF</title>
78
<meta name="description" content="Draw a border frame on every page of a PDF — pick margin, color, and stroke width — entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/border.html" />

‎compress.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Compress a PDF to 100KB, 1MB, or a target size — ClientPDF</title>
78
<meta name="description" content="Shrink a PDF's file size by re-encoding its images, entirely in your browser. Pick a target size — under 100KB, 500KB, or 1MB. Nothing is uploaded, ever." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/compress.html" />

‎crop.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Crop margins from a PDF without uploading it — ClientPDF</title>
78
<meta name="description" content="Trim the visible margins on every page of a PDF — set top, bottom, left, and right in points — entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/crop.html" />

‎delete-pages.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Delete pages from a PDF without uploading it — ClientPDF</title>
78
<meta name="description" content="Remove specific pages from a PDF and keep the rest as one file — entirely in your browser. Nothing is uploaded, ever. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/delete-pages.html" />

‎duplicate-pages.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Duplicate pages in a PDF without uploading it — ClientPDF</title>
78
<meta name="description" content="Duplicate specific pages inside a PDF — a cover page, a repeated form, a signature page — entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/duplicate-pages.html" />

‎extract-images.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Extract images from a PDF without uploading it — ClientPDF</title>
78
<meta name="description" content="Pulls the JPEG images embedded in a PDF back out as standalone .jpg files, or one .zip — entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/extract-images.html" />

‎fill-form.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Fill a PDF's form fields without uploading it — ClientPDF</title>
78
<meta name="description" content="Type values into a PDF's text fields, checkboxes, radio buttons, and dropdowns, then download the filled file — entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/fill-form.html" />

‎flatten.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.counterapi.dev https://formsubmit.co; object-src 'none'; base-uri 'self'; form-action 'self' https://formsubmit.co;" />
67
<title>Flatten PDF form fields without uploading it — ClientPDF</title>
78
<meta name="description" content="Convert a filled PDF form into permanent, non-editable content — fields, checkboxes, and dropdowns flattened entirely in your browser. Free, fast, private." />
89
<link rel="canonical" href="https://abyworkings-coder.github.io/clientpdf/flatten.html" />

0 commit comments

Comments
 (0)