Skip to content

trusted type fix #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kascit merged 13 commits into from
May 10, 2026
Merged

trusted type fix #33

Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
820f016
chore: sort versions.env keys
kascit May 3, 2026
0f3b10e
fix: resolve mobile animation, card layout, taxonomy tags, and CSP is…
kascit May 3, 2026
f2f8ba1
feat: add 'up' project, fix 'stuff' link, dynamically generate taxono…
kascit May 3, 2026
7bf3422
chore: minimal updates for UI and CI
kascit May 4, 2026
2bbe530
fix: resolve CodeQL alerts for XSS and dynamic method calls
kascit May 4, 2026
5f6ab83
perf: lazy-load JS modules, defer analytics, add FA subset + LQIP + s…
kascit May 9, 2026
4107f0e
perf: eliminate LCP render delay, FOUC flicker, and trim critical chain
kascit May 9, 2026
978991b
fix: trusted type default pass through
kascit May 9, 2026
c3696ed
fix: unified navbar and apps grid
kascit May 9, 2026
71ee9be
merge main, fix rss storage and feedly urls
kascit May 9, 2026
d58dfab
fix: resolve all super-linter violations
kascit May 9, 2026
00d45bd
fix: resolve TrustedHTML and URL encoding issues
kascit May 10, 2026
5b2fdbb
Merge branch 'main' into fix/unified-navbar
kascit May 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions templates/macros/head.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,14 @@
{% endif %}
<script>
if (window.trustedTypes && trustedTypes.createPolicy) {
if (!trustedTypes.defaultPolicy) {
try {
trustedTypes.createPolicy('default', {
createHTML: (string) => string,
createScript: (string) => string,
createScriptURL: (string) => string,
});
} catch (err) {
// Absorb duplicate policy errors silently to allow page execution to continue
}
}
</script>
Expand All @@ -52,7 +54,7 @@

<!-- Security headers are managed via edge configuration. -->
<!-- Fail-open CSP hand-off: fallback policy lives in this meta tag and is removed by the Cloudflare Worker when strict nonce CSP is injected as an HTTP header. -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://dhanur.me blob: https://*.dhanur.me https://www.googletagmanager.com https://www.google-analytics.com https://giscus.app https://utteranc.es https://static.cloudflareinsights.com https://gist.github.com https://asciinema.org https://challenges.cloudflare.com https://*.cloudflare.com https://*.sentry-cdn.com https://analytics.ahrefs.com; style-src 'self' 'unsafe-inline' https://*.dhanur.me https://fonts.googleapis.com https://giscus.app; font-src 'self' data: https://*.dhanur.me https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.dhanur.me https://*.sentry.io https://browser.sentry-cdn.com https://www.google-analytics.com https://stats.g.doubleclick.net https://analytics.ahrefs.com; manifest-src 'self' https://*.dhanur.me; frame-src 'self' https://giscus.app https://utteranc.es https://www.youtube.com https://codepen.io https://www.openstreetmap.org https://asciinema.org https://challenges.cloudflare.com; worker-src 'self' blob: https://*.dhanur.me; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'; trusted-types default giscus googletagmanager sentry 'allow-duplicates';">
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://dhanur.me blob: https://*.dhanur.me https://www.googletagmanager.com https://www.google-analytics.com https://giscus.app https://utteranc.es https://static.cloudflareinsights.com https://gist.github.com https://asciinema.org https://challenges.cloudflare.com https://*.cloudflare.com https://*.sentry-cdn.com https://analytics.ahrefs.com; style-src 'self' 'unsafe-inline' https://*.dhanur.me https://fonts.googleapis.com https://giscus.app; font-src 'self' data: https://*.dhanur.me https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.dhanur.me https://*.sentry.io https://browser.sentry-cdn.com https://www.google-analytics.com https://stats.g.doubleclick.net https://analytics.ahrefs.com; manifest-src 'self' https://*.dhanur.me; frame-src 'self' https://giscus.app https://utteranc.es https://www.youtube.com https://codepen.io https://www.openstreetmap.org https://asciinema.org https://challenges.cloudflare.com; worker-src 'self' blob: https://*.dhanur.me; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'; trusted-types default dompurify giscus googletagmanager sentry 'allow-duplicates';">
<meta name="referrer" content="strict-origin-when-cross-origin">
<meta name="application-name" content="{{ config.title | default(value='dhanur.me') }}">

Expand Down