jekyll-embed-urls 0.4.2 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c795f9b16237feeed30d70baee2b6146a51f056929924a295e5b0a1e293e24a0
-  data.tar.gz: f5824e1b91c6a060306b9d93f258decbf57d9f825dcdfb2592bd2e30581d9638
+  metadata.gz: 938576c9cdee4a9b13de0e7d2d17983db2704f7882352d5a88010c66c8ddb122
+  data.tar.gz: e34c7de8e8d9b4b36d3b995888015362fd1a561db17cd3b4304bca252f12168c
 SHA512:
-  metadata.gz: 83e610b927d530ea2e27b984517deb2046a2589320d2f79479581977ae340988492e4cc91717af7c15638347653c89759d578202a98b60a1887278f97029dfde
-  data.tar.gz: 5b24859efeb21b55efa2c2b686cdb7b44ef3a810f8e1fbcfe6530a155fdb36abeb57fadcd55cd7941ce16f45f65dee9977b60d246b24c0303ae2341ab83e8bea
+  metadata.gz: 3c4cb82fb1f9accb6250dbe4b0460cde02867b7bf4b1befb93d2ca8c2f1c4bdb7204c9ceb30847bea1b1f7283be4d72f33137fcbc01c08bfce2ae93cda593cb7
+  data.tar.gz: 0e9f02488eb339c43c33c7a90f0192af3c2e069f038b2b399f6eba991423853589277e88369c0d920e03003957e2d26f3106b487db8b0b300e414abf02394625

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v0.4.3
+
+* Correctly use Feature Policy
+
+## v0.4.2
+
+* Fix on v0.4.1
+
+## v0.4.1
+
+* Don't fail if remote URL returns an empty body
+
 ## v0.4.0
 
 * Almost a complete rewrite.

data/README.md

@@ -54,10 +54,10 @@ embed:
     - allow-scripts
     - allow-popups
     allow:
-    - fullscreen
-    - gyroscope
-    - picture-in-picture
-    - clipboard-write
+    - fullscreen;
+    - gyroscope;
+    - picture-in-picture;
+    - clipboard-write;
     loading: 'lazy'
     controls: true
     rel:
@@ -162,6 +162,15 @@ Anti-tracking techniques implemented are:
 If you find more useful techniques, please [open an issue
 report](https://0xacab.org/sutty/jekyll/jekyll-embed-urls/-/issues).
 
+## Feature policy
+
+[Feature
+policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
+is a list of directives for allowing or denying features.
+
+The directives are separated by semicolons.  Any directive not mentioned
+in the configuration is assumed to have a "none" policy by this plugin.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on 0xacab.org at

data/_includes/ogp.html

@@ -2,7 +2,7 @@
   {%- if page.video -%}
     <video poster="{{ page.image }}" class="img-fluid" {{ embed.controls }} src="{{ page.video }}"/>
   {%- elsif page.image -%}
-    <img referrerpolicy="{{ embed.referrerpolicy | join: ' ' }}" loading="{{ embed.loading }}" src="{{ page.image }}" class="img-fluid" />
+    <img referrerpolicy="{{ embed.referrerpolicy }}" loading="{{ embed.loading }}" src="{{ page.image }}" class="img-fluid" />
   {%- endif -%}
 
   {%- if page.audio -%}

data/lib/jekyll/embed.rb

@@ -55,6 +55,10 @@ module Jekyll
     MEDIA_ATTRIBUTES = %w[controls].freeze
     A_ATTRIBUTES = %w[referrerpolicy rel target].freeze
 
+    # Directive from Feature Policy
+    # @see {https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#directives}
+    DIRECTIVES = %w[accelerometer ambient-light-sensor autoplay battery camera display-capture document-domain encrypted-media execution-while-not-rendered execution-while-out-of-viewport fullscreen gamepad geolocation gyroscope layout-animations legacy-image-formats magnetometer microphone midi navigation-override oversized-images payment picture-in-picture publickey-credentials-get speaker-selection sync-xhr usb screen-wake-lock web-share xr-spatial-tracking].freeze
+
     # Templates
     INCLUDE_OGP = '{% include ogp.html site=site page=page %}'
     INCLUDE_FALLBACK = '{% include fallback.html site=site page=page %}'
@@ -74,7 +78,7 @@ module Jekyll
       'attributes' => {
         'referrerpolicy' => 'strict-origin-when-cross-origin',
         'sandbox' => %w[allow-scripts allow-popups],
-        'allow' => %w[fullscreen gyroscope picture-in-picture clipboard-write],
+        'allow' => %w[fullscreen; gyroscope; picture-in-picture; clipboard-write;],
         'loading' => 'lazy',
         'controls' => true,
         'rel' => %w[noopener noreferrer],
@@ -144,7 +148,9 @@ module Jekyll
 
       # @return [Hash]
       def config
-        @config ||= Jekyll::Utils.deep_merge_hashes(DEFAULT_CONFIG, (site.config['embed'] || {}))
+        @config ||= Jekyll::Utils.deep_merge_hashes(DEFAULT_CONFIG, (site.config['embed'] || {})).tap do |c|
+          c['attributes']['allow'].concat (DIRECTIVES - c.dig('attributes', 'allow').join.split(';').map { |s| s.split(' ').first }).join(" 'none';|").split('|')
+        end
       end
 
       # Try for OEmbed

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-embed-urls
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors:
 - f
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-06-09 00:00:00.000000000 Z
+date: 2021-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jekyll