jekyll-embed-urls 0.4.0 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30c09af02fb3b49b49ffae328a7c474377badc49f4a7d10e37c5077411b93e55
-  data.tar.gz: c66c5bf04fad8b11c7df5bef04e01a912a70a0b371dbb93cf14107bfb9de39c5
+  metadata.gz: a414c302d33fdb35c35e420ae07e6fc5c8f90e2fba9b4ba2e8b2961fbd94a8f4
+  data.tar.gz: bf0d28a49c111e48d7f02d6ddc9fc258356b0e1dc3409870bb75206549cab968
 SHA512:
-  metadata.gz: d4a9316874d7dfd7da173144c7eb608697b06432a5c10f2e9fa4d79ec61474a5bfc4d90ce214316a2659ee5a80147bfeee4d39851e6c88c18b0a9def4e6bd9f1
-  data.tar.gz: 20964fff6fcdaac00ceb536fbfd858e07984ed2f00e7eb59a5537a72a090700844de9133085e9509416de0386f18ac4620015f11be7979c6e347c44126153f30
+  metadata.gz: 9df2638f34fcbcee2a9ace50686fff8e22dff2c7168ca60673634032a97cf65fdb4b1e902e517aa81e5c1ffdc95e8a5f8eb4c53e3d160f6f872615b6b94cb7e6
+  data.tar.gz: eb64bf3fc323c3ec0159de2314aa8165c90a79ed95a21ecf497d8ec7aa2b79f4db3cf4e11c8386f0cf8a38c698e94af2c42b32440c656b044dbf216d780468b2

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v0.4.3
+
+* Correctly use Feature Policy
+
+## v0.4.2
+
+* Fix on v0.4.1
+
+## v0.4.1
+
+* Don't fail if remote URL returns an empty body
+
 ## v0.4.0
 
 * Almost a complete rewrite.

data/README.md

@@ -54,10 +54,10 @@ embed:
     - allow-scripts
     - allow-popups
     allow:
-    - fullscreen
-    - gyroscope
-    - picture-in-picture
-    - clipboard-write
+    - fullscreen;
+    - gyroscope;
+    - picture-in-picture;
+    - clipboard-write;
     loading: 'lazy'
     controls: true
     rel:
@@ -162,6 +162,15 @@ Anti-tracking techniques implemented are:
 If you find more useful techniques, please [open an issue
 report](https://0xacab.org/sutty/jekyll/jekyll-embed-urls/-/issues).
 
+## Feature policy
+
+[Feature
+policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
+is a list of directives for allowing or denying features.
+
+The directives are separated by semicolons.  Any directive not mentioned
+in the configuration is assumed to have a "none" policy by this plugin.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on 0xacab.org at

data/lib/jekyll/embed.rb

@@ -55,6 +55,10 @@ module Jekyll
     MEDIA_ATTRIBUTES = %w[controls].freeze
     A_ATTRIBUTES = %w[referrerpolicy rel target].freeze
 
+    # Directive from Feature Policy
+    # @see {https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#directives}
+    DIRECTIVES = %w[accelerometer ambient-light-sensor autoplay battery camera display-capture document-domain encrypted-media execution-while-not-rendered execution-while-out-of-viewport fullscreen gamepad geolocation gyroscope layout-animations legacy-image-formats magnetometer microphone midi navigation-override oversized-images payment picture-in-picture publickey-credentials-get speaker-selection sync-xhr usb screen-wake-lock web-share xr-spatial-tracking].freeze
+
     # Templates
     INCLUDE_OGP = '{% include ogp.html site=site page=page %}'
     INCLUDE_FALLBACK = '{% include fallback.html site=site page=page %}'
@@ -74,7 +78,7 @@ module Jekyll
       'attributes' => {
         'referrerpolicy' => 'strict-origin-when-cross-origin',
         'sandbox' => %w[allow-scripts allow-popups],
-        'allow' => %w[fullscreen gyroscope picture-in-picture clipboard-write],
+        'allow' => %w[fullscreen; gyroscope; picture-in-picture; clipboard-write;],
         'loading' => 'lazy',
         'controls' => true,
         'rel' => %w[noopener noreferrer],
@@ -144,7 +148,9 @@ module Jekyll
 
       # @return [Hash]
       def config
-        @config ||= Jekyll::Utils.deep_merge_hashes(DEFAULT_CONFIG, (site.config['embed'] || {}))
+        @config ||= Jekyll::Utils.deep_merge_hashes(DEFAULT_CONFIG, (site.config['embed'] || {})).tap do |c|
+          c['attributes']['allow'].concat (DIRECTIVES - c.dig('attributes', 'allow').join.split(';').map { |s| s.split(' ').first }).join(" 'none';|").split('|')
+        end
       end
 
       # Try for OEmbed
@@ -197,7 +203,7 @@ module Jekyll
             'title' => text(title),
             'description' => text(description),
             'url' => url,
-            'image' => element.css('img').first&.public_send(:[], 'src')
+            'image' => element&.css('img')&.first&.public_send(:[], 'src')
           }
 
           fallback_template.render! payload, context

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-embed-urls
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.4
 platform: ruby
 authors:
 - f
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-01 00:00:00.000000000 Z
+date: 2022-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jekyll
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.15'
+        version: 0.16.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.15'
+        version: 0.16.0
 - !ruby/object:Gem::Dependency
   name: loofah
   requirement: !ruby/object:Gem::Requirement