diff --git a/404.html b/404.html index f0273dc52..2c6a6a403 100644 --- a/404.html +++ b/404.html @@ -4,7 +4,7 @@ + content="default-src 'self'; script-src 'self' ; img-src *; connect-src 'self' https://www.openstreetmap.org/ https://api.openstreetmap.org/;"> @@ -41,7 +41,6 @@
- diff --git a/android b/android index 8a3b8f5ed..1a0e2abf2 160000 --- a/android +++ b/android @@ -1 +1 @@ -Subproject commit 8a3b8f5ed934c4ab5b15454907ccaa35a4ba552e +Subproject commit 1a0e2abf276f356d1c68e828608a4d5342589499 diff --git a/index.html b/index.html index 626628eda..04cf21dcf 100644 --- a/index.html +++ b/index.html @@ -4,7 +4,7 @@ + content="default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src * data: ; connect-src 'self' https://www.openstreetmap.org/ https://api.openstreetmap.org/;"> @@ -42,7 +42,6 @@
- diff --git a/inspector.html b/inspector.html index 0c458e944..66bd02772 100644 --- a/inspector.html +++ b/inspector.html @@ -12,7 +12,6 @@
Loading inspector...
- diff --git a/privacy.html b/privacy.html index 0e8ab8bdc..83701eb34 100644 --- a/privacy.html +++ b/privacy.html @@ -3,7 +3,7 @@ - + @@ -38,7 +38,5 @@
- - diff --git a/scripts/generateLayouts.ts b/scripts/generateLayouts.ts index 43262ff50..ab592e832 100644 --- a/scripts/generateLayouts.ts +++ b/scripts/generateLayouts.ts @@ -439,7 +439,6 @@ class GenerateLayouts extends Script { "style-src": "'self' 'unsafe-inline'", // unsafe-inline is needed to change the default background pin colours "script-src": [ "'self'", - "https://gc.zgo.at/count.js", ...(options?.scriptSrcs?.map((s) => "'" + s + "'") ?? []), ].join(" "), "connect-src": "'self' " + connectSrc.join(" "), diff --git a/src/loadGoatcounter.js b/src/loadGoatcounter.js deleted file mode 100644 index 314639453..000000000 --- a/src/loadGoatcounter.js +++ /dev/null @@ -1,7 +0,0 @@ -const script = document.createElement("script") -script.async = true -script.dataset.goatcounter = "https://pietervdvn.goatcounter.com/count" -script.src = "https://gc.zgo.at/count.js" -script.crossOrigin = "anonymous" -script.integrity = "sha384-atnOLvQb9t+jTSipvd75X2yginT4PjVbqDdlJAmxMm+wYElFmeR6EmLP5bYeoRVQ" -document.head.appendChild(script) diff --git a/statistics.html b/statistics.html index 935ad2a04..14e7cc057 100644 --- a/statistics.html +++ b/statistics.html @@ -12,7 +12,6 @@
Loading statistics...
- diff --git a/status.html b/status.html index 0f1d12732..b2b6494d4 100644 --- a/status.html +++ b/status.html @@ -13,7 +13,6 @@
- diff --git a/studio.html b/studio.html index 9624b3f0e..73d7dfed8 100644 --- a/studio.html +++ b/studio.html @@ -19,7 +19,6 @@
- diff --git a/test/CodeQuality.spec.ts b/test/CodeQuality.spec.ts index 741d7f2fd..da90072b8 100644 --- a/test/CodeQuality.spec.ts +++ b/test/CodeQuality.spec.ts @@ -154,20 +154,7 @@ describe("Code quality", () => { ) ) - test("scripts with external sources should have an integrity hash", async () => { - const htmlFiles = ScriptUtils.readDirRecSync(".", 1).filter((f) => f.endsWith(".html")) - for (const htmlFile of htmlFiles) { - await validateScriptIntegrityOf(htmlFile) - } - const goatCounter = "https://gc.zgo.at/count.js" - const data: string = (await ScriptUtils.Download(goatCounter))["content"] - const hashed = await webcrypto.subtle.digest("SHA-384", new TextEncoder().encode(data)) - const hashedB64 = _arrayBufferToBase64(hashed) - const goatCounterScript = readFileSync("./src/loadGoatcounter.js", "utf-8") - if (goatCounterScript.indexOf(hashedB64) < 0) { - throw "Hash sha-384" + hashedB64 + " not found in 'loadGoatcounter.js'" - } - }) + /* itAsync( "should not contain 'import * as name from \"xyz.json\"'", diff --git a/theme.html b/theme.html index 1526f204b..108df7ef7 100644 --- a/theme.html +++ b/theme.html @@ -92,9 +92,7 @@ - -