jekyll-embed-urls 0.4.2 → 0.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c795f9b16237feeed30d70baee2b6146a51f056929924a295e5b0a1e293e24a0
-  data.tar.gz: f5824e1b91c6a060306b9d93f258decbf57d9f825dcdfb2592bd2e30581d9638
+  metadata.gz: ec91f328eea6a0559fa41ffbfec9bccd3e3a19662369c36331cfaa8d6dc8d4fc
+  data.tar.gz: 47b8560d986e6083de1538ab0a372756705579af46d8b4d725051f2f52ad15f9
 SHA512:
-  metadata.gz: 83e610b927d530ea2e27b984517deb2046a2589320d2f79479581977ae340988492e4cc91717af7c15638347653c89759d578202a98b60a1887278f97029dfde
-  data.tar.gz: 5b24859efeb21b55efa2c2b686cdb7b44ef3a810f8e1fbcfe6530a155fdb36abeb57fadcd55cd7941ce16f45f65dee9977b60d246b24c0303ae2341ab83e8bea
+  metadata.gz: 5cb5c650b7e79ec5ff0ea074acdbf2334dce4f310a1cc670613f31313dce81368a8a216d468bd73762fab08a13ccfe34d5f5d6887602d8fcc80f07dba5e8c120
+  data.tar.gz: f3b16a6d48a274cdd83fa710d5e0e7cec88bd281bd578dba5dd7bccba3d509f9d3a7ecb124f058c73e11687ea273d56c4194599ad552cdf35e4aac3c1b033420

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v0.4.3
+
+* Correctly use Feature Policy
+
+## v0.4.2
+
+* Fix on v0.4.1
+
+## v0.4.1
+
+* Don't fail if remote URL returns an empty body
+
 ## v0.4.0
 
 * Almost a complete rewrite.

data/README.md

@@ -54,10 +54,10 @@ embed:
     - allow-scripts
     - allow-popups
     allow:
-    - fullscreen
-    - gyroscope
-    - picture-in-picture
-    - clipboard-write
+    - fullscreen;
+    - gyroscope;
+    - picture-in-picture;
+    - clipboard-write;
     loading: 'lazy'
     controls: true
     rel:
@@ -162,6 +162,15 @@ Anti-tracking techniques implemented are:
 If you find more useful techniques, please [open an issue
 report](https://0xacab.org/sutty/jekyll/jekyll-embed-urls/-/issues).
 
+## Feature policy
+
+[Feature
+policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
+is a list of directives for allowing or denying features.
+
+The directives are separated by semicolons.  Any directive not mentioned
+in the configuration is assumed to have a "none" policy by this plugin.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on 0xacab.org at

data/_includes/ogp.html

@@ -2,7 +2,7 @@
   {%- if page.video -%}
     <video poster="{{ page.image }}" class="img-fluid" {{ embed.controls }} src="{{ page.video }}"/>
   {%- elsif page.image -%}
-    <img referrerpolicy="{{ embed.referrerpolicy | join: ' ' }}" loading="{{ embed.loading }}" src="{{ page.image }}" class="img-fluid" />
+    <img referrerpolicy="{{ embed.referrerpolicy }}" loading="{{ embed.loading }}" src="{{ page.image }}" class="img-fluid" />
   {%- endif -%}
 
   {%- if page.audio -%}

data/lib/jekyll/embed.rb

@@ -55,6 +55,10 @@ module Jekyll
     MEDIA_ATTRIBUTES = %w[controls].freeze
     A_ATTRIBUTES = %w[referrerpolicy rel target].freeze
 
+    # Directive from Feature Policy
+    # @see {https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#directives}
+    DIRECTIVES = %w[accelerometer ambient-light-sensor autoplay battery camera display-capture document-domain encrypted-media execution-while-not-rendered execution-while-out-of-viewport fullscreen gamepad geolocation gyroscope layout-animations legacy-image-formats magnetometer microphone midi navigation-override oversized-images payment picture-in-picture publickey-credentials-get speaker-selection sync-xhr usb screen-wake-lock web-share xr-spatial-tracking].freeze
+
     # Templates
     INCLUDE_OGP = '{% include ogp.html site=site page=page %}'
     INCLUDE_FALLBACK = '{% include fallback.html site=site page=page %}'
@@ -74,7 +78,7 @@ module Jekyll
       'attributes' => {
         'referrerpolicy' => 'strict-origin-when-cross-origin',
         'sandbox' => %w[allow-scripts allow-popups],
-        'allow' => %w[fullscreen gyroscope picture-in-picture clipboard-write],
+        'allow' => %w[fullscreen; gyroscope; picture-in-picture; clipboard-write;],
         'loading' => 'lazy',
         'controls' => true,
         'rel' => %w[noopener noreferrer],
@@ -103,10 +107,13 @@ module Jekyll
 
         # Add the _includes dir so we can provide default templates that
         # can be overriden locally or by the theme.
-        site.includes_load_paths << File.expand_path(File.join(__dir__, '..', '..', '_includes'))
+        includes_dir = File.expand_path(File.join(__dir__, '..', '..', '_includes'))
+        site.includes_load_paths << includes_dir unless site.includes_load_paths.include? includes_dir
         # Since we're embedding, we're allowing iframes
         Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2 << 'iframe'
 
+        reset
+
         # Other elements that are disallowed
         config['scrub']&.each do |scrub|
           Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2.delete(scrub)
@@ -117,6 +124,23 @@ module Jekyll
         site
       end
 
+      # Reset variables
+      #
+      # @return [nil]
+      def reset
+        @allow_same_origin =
+          @cache =
+          @config =
+          @fallback_template =
+          @get_cache =
+          @http_client =
+          @info =
+          @ogp_template =
+          @payload =
+          @value_for_attr =
+          nil
+      end
+
       # Render the URL as HTML
       #
       # 1. Try oembed for video and image
@@ -144,7 +168,9 @@ module Jekyll
 
       # @return [Hash]
       def config
-        @config ||= Jekyll::Utils.deep_merge_hashes(DEFAULT_CONFIG, (site.config['embed'] || {}))
+        @config ||= Jekyll::Utils.deep_merge_hashes(DEFAULT_CONFIG, (site.config['embed'] || {})).tap do |c|
+          c['attributes']['allow'].concat (DIRECTIVES - c.dig('attributes', 'allow').join.split(';').map { |s| s.split(' ').first }).join(" 'none';|").split('|')
+        end
       end
 
       # Try for OEmbed

data/lib/jekyll-embed-urls.rb

@@ -4,6 +4,6 @@ require_relative 'jekyll/embed'
 require_relative 'jekyll/embed/filter'
 
 # Configure Embed
-Jekyll::Hooks.register :site, :after_init do |site|
+Jekyll::Hooks.register :site, :after_reset do |site|
   Jekyll::Embed.site = site
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-embed-urls
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.5
 platform: ruby
 authors:
 - f
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-06-09 00:00:00.000000000 Z
+date: 2022-02-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jekyll
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.15'
+        version: 0.16.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.15'
+        version: 0.16.0
 - !ruby/object:Gem::Dependency
   name: loofah
   requirement: !ruby/object:Gem::Requirement
@@ -174,7 +174,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: Embed URL previsualization in Jekyll posts