abqari 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9d5e9a272de668ea9e75b33d47fd252c9a46413c6873c15d077a938f3817004
-  data.tar.gz: 0d55679d1de17c940765b5a04c81e15980e1929a590fab878b36e65fdc877195
+  metadata.gz: ac44a7f76fcb30cb218104f9e002a0cd958518542912393d7681fceab92abdf0
+  data.tar.gz: 8a0cc5fe35425ca6571dbc76549df5105106bf8ff672f67ea9101c26e48af550
 SHA512:
-  metadata.gz: 27ecd3e0f352ce9970cd85256badd8973bcd950092fa67cd56de2f9820862eef89740b3995d8c3e7f692259a9f50d49da1d41e3a76d7912c0873d650b46d101a
-  data.tar.gz: 77b4d04a24911bf1705cb074ce4515bd130ee5db2340e1c988c81a5a707c54014bf5a62cc94ca1d83139747d7c87595a3c7c2607a79ae9b2f953c926b7f16d43
+  metadata.gz: 9050a56ac582b3cdb3f4590bf90f6543ee57fa0dd6e1c4b56afc7274a937dfbb805400869d157473019af1a9802da7e88af97e30961f436cbed8a2472f2bb6cb
+  data.tar.gz: db4d7cb9c339676e76cc794b8e205fb0000d50266d8b28ae6a53770b7d701a44fd3664d3f3d2076e3fc78cd2f08745ab442a4abd85a5bcbdbb0ef14586a8f26b

data/CHANGELOG.md

@@ -9,6 +9,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _Nothing yet._
 
+## [1.3.0] — 2026-10-11
+
+If CI runs `bin/audit --strict`, run `bin/audit` locally before
+upgrading: a new Security check can fail an audit that passed on
+1.2.0. Every finding is inline code that is already blocked on any host
+that enforces the site's CSP, so the fix is in the site, not the
+policy.
+
+### Added
+
+- **`bin/audit` now fails on inline code the site's own CSP would
+  block.** The generated policy has `style-src 'self'` and pins inline
+  scripts by hash, so a template that adds `style="…"`, a `<style>`
+  block, an `onclick=`, or an unhashed `<script>` breaks on any host
+  that enforces the CSP. It hid because nothing local enforces it: the
+  dev server doesn't apply `_headers`, the page renders, and the
+  browser only logs a console error. One site had 52 inline
+  `style="--ratio: …"` attributes that would have collapsed every photo
+  pane the moment its CSP went live.
+
+  The new **Security** category (`Audit::Csp`) checks every page
+  against the CSP in the built `_headers`, so a `headers:` override or
+  `csp:` extension is what's checked. It reports one error per page per
+  kind of inline code, with an example and how to fix it. It follows
+  the spec: hashes, `'unsafe-inline'` (ignored once a hash or nonce is
+  present), `'unsafe-hashes'` for attributes, the `-elem`/`-attr`
+  directives and the `default-src` fallback. `bin/audit --strict` fails
+  on these, so a site that passed yesterday can fail today; every
+  finding is code that is already broken wherever the policy is
+  applied.
+
 ## [1.2.0] — 2026-10-11
 
 Upgrade if you serve the generated CSP: Chrome has been blocking
@@ -1110,7 +1141,8 @@ run a real working author / publisher site.
   commonmarker ≥ 2.4 ships precompiled 4.0 binaries, which is what
   the `~> 2.4` floor bought.
 
-[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.2.0...HEAD
+[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.3.0...HEAD
+[1.3.0]: https://github.com/grantrayner/abqari/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/grantrayner/abqari/compare/v1.1.2...v1.2.0
 [1.1.2]: https://github.com/grantrayner/abqari/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/grantrayner/abqari/compare/v1.1.0...v1.1.1

data/README.md

@@ -11,7 +11,7 @@ optional overrides), while the engine — layouts, themes, helpers, asset
 pipeline — lives in the dependency. Forking the engine is also
 supported for users who want to own all the code.
 
-> **Status:** v1.2.0 — see
+> **Status:** v1.3.0 — see
 > [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md).
 > Distributed via RubyGems (`gem install abqari`) and as a Bundler
 > path/git source. The API follows [semver](https://semver.org/) from
@@ -174,7 +174,7 @@ Test that it worked:
 abqari version
 ```
 
-You should see a version number, e.g. `abqari 1.2.0`. If you get
+You should see a version number, e.g. `abqari 1.3.0`. If you get
 `command not found`, see [Troubleshooting](#troubleshooting) below.
 
 ### Step 3 — Create your first site
@@ -460,7 +460,7 @@ Edit `Gemfile`:
 ```ruby
 source 'https://rubygems.org'
 
-gem 'abqari', '~> 1.2'
+gem 'abqari', '~> 1.3'
 
 group :development do
   gem 'listen', '~> 3.8'    # optional, for the dev-server file watcher
@@ -470,7 +470,7 @@ end
 Or — pin to a git ref while tracking pre-release work:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.2.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.0'
 ```
 
 Install the libvips C library once (hard dep for the image pipeline):
@@ -2331,6 +2331,7 @@ Rebuilds the site, walks the output, and writes a markdown report to `audit/<YYY
 | **Privacy** | External resource loads (URLs not on the site host) |
 | **Dependencies** | Outdated gems via `bundle outdated`, CVEs via `bundle-audit` (if installed) |
 | **Content** | Posts without descriptions, single-use tags, `series_position` problems that break prev/next silently (non-Integer, duplicate, or missing) |
+| **Security** | Inline code the built `_headers` CSP would block: `style="…"` attributes, `<style>` blocks, `on…=` handlers, and inline scripts whose hash isn't in `script-src`. Errors, because the page breaks on any host that enforces the policy |
 
 The report opens with a summary table, a **Suggested fixes** code block listing every `bundle update <gem>` command needed to clear the dependency findings, and then groups findings by category with severity (`error`, `warn`, `info`) and a suggestion where applicable. Reports accumulate in `audit/` — useful to commit so you have a diffable history of site quality over time.
 
@@ -2365,7 +2366,7 @@ GitHub Dependabot does three things abqari's audit does **not**:
 
 What `bin/audit` does that Dependabot doesn't:
 
-- **Same report covers links, SEO, accessibility, privacy, and content.** Dependabot only watches dependencies.
+- **Same report covers links, SEO, accessibility, privacy, content, and the CSP.** Dependabot only watches dependencies.
 - **Uses the same `ruby-advisory-db`** Dependabot's Ruby ecosystem coverage uses, just at a single point in time.
 - **Outputs to git-trackable markdown.** A diffable `audit/` history of every check you've run.
 
@@ -2558,14 +2559,14 @@ bin/audit                  # verify nothing regressed
 ```
 
 `abqari new` scaffolds the Gemfile pinned to the current major.minor
-(`gem 'abqari', '~> 1.2'` as of this release). Bundler reads that as
-`>= 1.2, < 2.0`, so `bundle update abqari` takes minor and patch
+(`gem 'abqari', '~> 1.3'` as of this release). Bundler reads that as
+`>= 1.3, < 2.0`, so `bundle update abqari` takes minor and patch
 releases but never a major one, which is the release that can need
 changes to your site. To track a fork or an unreleased branch
 instead, swap the line for a git source:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.2.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.0'
 ```
 
 The cadence: read [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md) before each upgrade,

data/lib/abqari/audit/csp.rb

@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'cgi'
+require 'digest'
+
+module Abqari
+  class Audit
+    # CSP rule. Checks every page's inline code against the
+    # Content-Security-Policy the same build wrote to `_headers`: inline
+    # `<script>` and `<style>` blocks, `style="…"` attributes and `on…=`
+    # event handlers.
+    #
+    # The policy is strict on purpose (`style-src 'self'`, scripts pinned
+    # by hash), so anything a template adds inline is blocked wherever
+    # the CSP is enforced — and nothing else notices. The dev server
+    # doesn't apply `_headers`, the page still renders, and the browser
+    # only logs a console error. One site carried 52 inline
+    # `style="--ratio: …"` attributes that would have collapsed every
+    # photo pane, and the engine's own speculation-rules block shipped in
+    # 1.1.x allowed only by a keyword Chrome ignores.
+    #
+    # Reads the BUILT `_headers`, not the engine's defaults, so a
+    # `headers:` override or `csp:` extension in site.yml is what gets
+    # checked. Error-severity: on a host that enforces the policy the
+    # page is broken. A site on a host that ignores `_headers` (GitHub
+    # Pages) will see these too; the code is still blocked the day the
+    # policy is applied.
+    class Csp < Rule
+      # Script types the browser executes, so CSP governs them. Any other
+      # `type` is a data block (JSON-LD, templates) and CSP ignores it.
+      EXECUTABLE_TYPES = %w[
+        text/javascript application/javascript application/ecmascript text/ecmascript
+        module importmap speculationrules
+      ].freeze
+      HASH_ALGORITHMS = { 'sha256' => Digest::SHA256, 'sha384' => Digest::SHA384, 'sha512' => Digest::SHA512 }.freeze
+
+      # Most specific directive first, as browsers resolve them.
+      DIRECTIVES = {
+        script:     %w[script-src-elem script-src default-src],
+        script_attr: %w[script-src-attr script-src default-src],
+        style:      %w[style-src-elem style-src default-src],
+        style_attr: %w[style-src-attr style-src default-src]
+      }.freeze
+
+      LABELS = {
+        script:      'inline <script>',
+        script_attr: 'inline event handler',
+        style:       '<style> block',
+        style_attr:  'style attribute'
+      }.freeze
+
+      ADVICE = {
+        script:      'Move it to a file under app/assets/js/, or add its sha256 to the CSP. ' \
+                     'For the engine\'s own scripts, upgrade abqari and re-copy the CSP.',
+        script_attr: 'Attach the handler from a script file with addEventListener instead.',
+        style:       'Move the rules into app/assets/css/site.css.',
+        style_attr:  'Move the styles into app/assets/css/site.css as a class, or a data ' \
+                     'attribute matched by an attribute selector for per-element values.'
+      }.freeze
+
+      def run
+        policies = csp_policies
+        return if policies.empty?
+
+        html_files.each do |file|
+          url = page_url(file)
+          applicable = policies.select { |prefix, _| url.start_with?(prefix) }.map(&:last)
+          next if applicable.empty?
+
+          check_page(url, File.read(file, encoding: 'UTF-8'), applicable)
+        end
+      end
+
+      private
+
+      # `[[path_prefix, { directive => [sources] }]]` for every CSP rule in
+      # the built `_headers`. More than one can apply to a page; the
+      # browser enforces all of them, so inline code has to pass each.
+      def csp_policies
+        path = File.join(@site.output_dir, '_headers')
+        return [] unless File.file?(path)
+
+        HeadersFile.parse(File.read(path, encoding: 'UTF-8'))
+                   .select { |rule| rule['name'].casecmp?('Content-Security-Policy') }
+                   .map { |rule| [rule['path'].delete_suffix('*'), parse_policy(rule['value'])] }
+      end
+
+      def parse_policy(value)
+        value.split(';').each_with_object({}) do |directive, policy|
+          name, *sources = directive.strip.split(/\s+/)
+          policy[name.downcase] = sources if name
+        end
+      end
+
+      def check_page(url, html, policies)
+        blocked = Hash.new { |h, k| h[k] = [] }
+        inline_code(html).each do |kind, content, type|
+          policy = policies.find { |pol| !allowed?(pol, kind, content, type) }
+          blocked[kind] << [content, policy] if policy
+        end
+
+        blocked.each do |kind, hits|
+          content, policy = hits.first
+          directive = DIRECTIVES[kind].find { |d| policy.key?(d) }
+          count = hits.size
+          add(category: 'security', severity: 'error', location: url,
+              message: "#{count} #{LABELS[kind]}#{'s' unless count == 1} blocked by the CSP " \
+                       "(#{directive} #{policy[directive].join(' ')}), e.g. #{example(kind, content)}",
+              suggestion: ADVICE[kind])
+        end
+      end
+
+      # Each piece of inline code as `[kind, content, script_type]`, where
+      # content is exactly what the browser hashes.
+      def inline_code(html)
+        html = html.gsub(/<!--.*?-->/m, '')
+        code = []
+
+        html.scan(%r{<script\b([^>]*)>(.*?)</script>}mi).each do |attrs, body|
+          next if attribute(attrs, 'src')
+
+          type = attribute(attrs, 'type')&.strip&.downcase
+          next unless type.nil? || type.empty? || EXECUTABLE_TYPES.include?(type)
+
+          code << [:script, body, type]
+        end
+        html.scan(%r{<style\b[^>]*>(.*?)</style>}mi).each { |(body)| code << [:style, body] }
+
+        # Attributes, with script and style bodies removed first so a
+        # string inside a script that looks like markup isn't counted.
+        tags_only = html.gsub(%r{<(script|style)\b[^>]*>.*?</\1>}mi, '')
+        tags_only.scan(/<[a-zA-Z][^>]*>/).each do |tag|
+          tag.scan(/\s(on[a-z]+|style)\s*=\s*(?:"([^"]*)"|'([^']*)')/i).each do |name, dq, sq|
+            code << [name.casecmp?('style') ? :style_attr : :script_attr, CGI.unescapeHTML(dq || sq)]
+          end
+        end
+        code
+      end
+
+      def attribute(attrs, name)
+        match = attrs.match(/\b#{name}\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i)
+        match && (match[1] || match[2] || match[3])
+      end
+
+      # Mirrors the CSP spec's inline checks: a hash or nonce in the list
+      # switches `'unsafe-inline'` off; attribute hashes count only with
+      # `'unsafe-hashes'`. `'inline-speculation-rules'` is honoured only
+      # when the list has no hash or nonce: Chrome reports a block allowed
+      # by nothing but the keyword as a violation once hashes are present.
+      def allowed?(policy, kind, content, type = nil)
+        directive = DIRECTIVES[kind].find { |d| policy.key?(d) }
+        return true unless directive
+
+        sources = policy[directive]
+        hashed = sources.any? { |s| s.match?(/\A'(sha256|sha384|sha512|nonce)-/i) }
+        hashed ||= kind == :script && sources.include?("'strict-dynamic'")
+        return true if sources.include?("'unsafe-inline'") && !hashed
+        return true if type == 'speculationrules' && sources.include?("'inline-speculation-rules'") && !hashed
+        return false if %i[style_attr script_attr].include?(kind) && !sources.include?("'unsafe-hashes'")
+
+        HASH_ALGORITHMS.any? do |alg, digest|
+          sources.include?("'#{alg}-#{Base64.strict_encode64(digest.digest(content))}'")
+        end
+      end
+
+      def example(kind, content)
+        snippet = content.strip.gsub(/\s+/, ' ')
+        snippet = "#{snippet[0, 60]}…" if snippet.length > 60
+        case kind
+        when :style_attr  then %(style="#{snippet}")
+        when :script_attr then %(handler "#{snippet}")
+        else %(`#{snippet}`)
+        end
+      end
+    end
+  end
+end

data/lib/abqari/audit.rb

@@ -12,6 +12,7 @@ require_relative 'audit/privacy'
 require_relative 'audit/performance'
 require_relative 'audit/dependencies'
 require_relative 'audit/content'
+require_relative 'audit/csp'
 
 module Abqari
   # Site audit orchestrator. Each check lives in its own rule class
@@ -36,14 +37,15 @@ module Abqari
       'privacy' => 'Privacy',
       'perf'    => 'Performance',
       'deps'    => 'Dependencies',
-      'content' => 'Content'
+      'content' => 'Content',
+      'security' => 'Security'
     }.freeze
 
     # Rule classes, in execution order. Order matters only for the
     # output report — findings are grouped by category, not insertion
     # order — but Links first keeps the report scan-friendly: errors
     # appear before warnings.
-    RULES = [Links, SEO, A11y, Privacy, Performance, Dependencies, Content].freeze
+    RULES = [Links, SEO, A11y, Privacy, Performance, Dependencies, Content, Csp].freeze
 
     attr_reader :findings
 

data/lib/abqari/cli/headers.rb

@@ -47,21 +47,8 @@ module Abqari
         true
       end
 
-      # `_headers` blocks: an unindented path line, then indented
-      # `Name: value` lines. Same shape HeadersFile writes, for both the
-      # generated policy and a `headers:` override in site.yml.
       def parse(text)
-        path = nil
-        text.each_line.with_object([]) do |line, rules|
-          next if line.strip.empty? || line.lstrip.start_with?('#')
-
-          if line.match?(/\A\S/)
-            path = line.strip
-          elsif path
-            name, value = line.strip.split(/:\s*/, 2)
-            rules << { 'path' => path, 'name' => name, 'value' => value.to_s } unless name.to_s.empty?
-          end
-        end
+        HeadersFile.parse(text)
       end
 
       private

data/lib/abqari/headers_file.rb

@@ -31,6 +31,24 @@ module Abqari
       'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains'
     }.freeze
 
+    # A `_headers` file as `{ 'path', 'name', 'value' }` rules: an
+    # unindented path line, then indented `Name: value` lines. The shape
+    # `build` writes, for both the generated policy and a `headers:`
+    # override. Read back by `abqari headers` and the CSP audit.
+    def self.parse(text)
+      path = nil
+      text.each_line.with_object([]) do |line, rules|
+        next if line.strip.empty? || line.lstrip.start_with?('#')
+
+        if line.match?(/\A\S/)
+          path = line.strip
+        elsif path
+          name, value = line.strip.split(/:\s*/, 2)
+          rules << { 'path' => path, 'name' => name, 'value' => value.to_s } unless name.to_s.empty?
+        end
+      end
+    end
+
     def initialize(site)
       @site = site
     end

data/lib/abqari/version.rb

@@ -14,5 +14,5 @@
 #
 # Keep this file dependency-free.
 module Abqari
-  VERSION = '1.2.0'
+  VERSION = '1.3.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: abqari
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Grant Rayner
@@ -220,6 +220,7 @@ files:
 - lib/abqari/audit.rb
 - lib/abqari/audit/a11y.rb
 - lib/abqari/audit/content.rb
+- lib/abqari/audit/csp.rb
 - lib/abqari/audit/dependencies.rb
 - lib/abqari/audit/links.rb
 - lib/abqari/audit/performance.rb