jekyll-theme-centos 2.52.0.beta.78 → 2.52.0.beta.79

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbe756786a2e1582e88c6e174721d3f3457d81aa5d9ea4846e8b53ff0bca3a19
-  data.tar.gz: b9e9098fde19be75627b7f3239825b7aa3fc5daad2bcd8e1f7180c4d5cabc0a4
+  metadata.gz: 1b990c61640d3b32c7cbd850d7a2cefd242c7dc294441e900cd5ba58c799f265
+  data.tar.gz: 4d4dee0ce7d789549891d898f6e319298a1e43b7d91a333e05837d2b4f347646
 SHA512:
-  metadata.gz: f4e02695884ce448834ffe7a961d5b8905a1cf8cb4367935f8a8566c10403da74dd7d05c9976f2f1ac9ac10e2e3a1d53c6f0be314ddb4310f299c8b7521491de
-  data.tar.gz: 3069b56eca0abfed57106906af11cc84e6c8b9b236889ce4d8333a14e8925b1c4ddd47b3fb9fa3cd01df2881b231db684c43b72bc196569b79e4668a22399c6f
+  metadata.gz: '0983a61c93b725fbb45ae64b5b51e2314dc6e984784ca9ed1ec216a85eaa867b9cc7e36a342351978a441f59b3cbb165df970991873d5efcebef390a05c63dbd'
+  data.tar.gz: 1340c3efc761f3991f2440a47bbdba2c023f9a050765dc8093dfea21bce956e7e0d737a9551e1cff8833c5ae73dec0cab6b2e49ed48d9003dc55415053d57412

data/_includes/base/color-table.html.liquid

@@ -18,13 +18,16 @@
 {%- else %}
 {%- assign _item_name = item.name %}
 {%- endif %}
+{%- assign _webaim_fcolor = item.text_color_hex | remove: '#' | upcase %}
+{%- assign _webaim_bcolor = item.hex | remove: '#' | upcase %}
+{%- capture _webaim_link %}https://webaim.org/resources/contrastchecker/?fcolor={{ _webaim_fcolor }}&bcolor={{ _webaim_bcolor }}{%- endcapture %}
     <tr>
       <td class="text-nowrap">{{ _item_name }}</td>
       <td class="text-nowrap"><i class="fas fa-circle fa-xl" style="color: {{ item.hex }}"></i><span role="button" class="copy-btn" data-bs-toggle="tooltip" data-bs-title="Copy hex value" data-copy-value="{{ item.hex }}" aria-label="Copy hex value {{ item.hex }}"><code>{{ item.hex }}</code> <span class="fa-regular fa-copy"></span></span></td>
       <td class="text-nowrap"><span role="button" class="copy-btn" data-bs-toggle="tooltip" data-bs-title="Copy RGB value" data-copy-value="{{ item.rgb }}" aria-label="Copy RGB value {{ item.rgb }}"><code>{{ item.rgb }}</code> <span class="fa-regular fa-copy"></span></span></td>
       <td class="text-nowrap"><span role="button" class="copy-btn" data-bs-toggle="tooltip" data-bs-title="Copy HSV value" data-copy-value="{{ item.hsv }}" aria-label="Copy HSV value {{ item.hsv }}"><code>{{ item.hsv }}</code> <span class="fa-regular fa-copy"></span></span></td>
       <td><span class="badge {{ item.text_badge }}">{{ item.text_color }}</span></td>
-      <td class="text-nowrap"><code>{{ item.contrast_ratio | remove: '`' }}</code> <a href="https://webaim.org/resources/contrastchecker/?fcolor={{ item.text_color_hex | remove: '#' | upcase }}&bcolor={{ item.hex | remove: '#' | upcase }}" target="_blank" class="text-decoration-none" data-bs-toggle="tooltip" title="Verify with WebAIM" aria-label="Verify contrast ratio with WebAIM"><i class="fas fa-external-link-alt"></i></a></td>
+      <td class="text-nowrap"><code>{{ item.contrast_ratio | remove: '`' }}</code> {% include base/link.html.liquid link=_webaim_link target="_blank" class="text-decoration-none" icon="fas fa-external-link-alt" data_bs_toggle="tooltip" data_bs_title="Verify with WebAIM" aria_label="Verify contrast ratio with WebAIM" %}</td>
       <td class="text-nowrap">{% if item.wcag_2_2_aa %}<span class="d-inline-block" data-bs-toggle="tooltip" title="Exceeds WCAG 2.2 AA standard (4.5:1 minimum)"><i class="fas fa-circle-check text-success"></i></span>{% else %}<span class="d-inline-block" data-bs-toggle="tooltip" title="Underperforms WCAG 2.2 AA standard (4.5:1 minimum)"><i class="fas fa-circle-xmark text-danger"></i></span>{% endif %} <code>{{ item.wcag_2_2_aa_margin | remove: '`' }}</code></td>
       <td class="text-nowrap">{% if item.wcag_2_2_aaa %}<span class="d-inline-block" data-bs-toggle="tooltip" title="Exceeds WCAG 2.2 AAA standard (7.0:1 minimum)"><i class="fas fa-circle-check text-success"></i></span>{% else %}<span class="d-inline-block" data-bs-toggle="tooltip" title="Underperforms WCAG 2.2 AAA standard (7.0:1 minimum)"><i class="fas fa-circle-xmark text-danger"></i></span>{% endif %} <code>{{ item.wcag_2_2_aaa_margin | remove: '`' }}</code></td>
     </tr>

data/_includes/base/copyvalue.html.liquid

@@ -2,18 +2,29 @@
 ================================================================================
 Template: Copy Value Component
 Purpose: Copy to clipboard with visual feedback (checkmark + tooltip).
-Auto-detects and handles both escaped and unescaped values.
+Decodes HTML-entity-escaped values back to plain text before copying.
 ================================================================================
 
-Recommended Usage (in template):
+Required Usage (in template):
   <span role="button" class="copy-btn" data-copy-value="{{ command | escape }}"
         data-bs-toggle="tooltip" data-bs-title="Copy command">
     <span class="fa-regular fa-copy"></span>
   </span>
 
+SECURITY — `data-copy-value` MUST always go through Liquid's `| escape` (or
+equivalent HTML-attribute encoding) at the point where it is written, with no
+exception for values that "look safe". The JS below decodes HTML entities
+(&quot;, &amp;, &#39;, …) back to plain text before copying so the clipboard
+receives the original string rather than its escaped form — this decoding is
+a UX convenience, not sanitization, and provides no protection if the value
+was interpolated unescaped in the first place. An unescaped, attacker-
+influenced value (a query parameter, CMS field, etc.) placed directly in
+data-copy-value breaks out of the HTML attribute at render time, before this
+script ever runs.
+
 Strategic Design Logic:
-- Armored implementation: handles escaped and unescaped values
-- HTML entity detection: decodes &quot;, &amp;, &#39; automatically
+- HTML entity decoding: reverses &quot;, &amp;, &#39; encoding so the
+  clipboard receives plain text, independent of how the value was escaped
 - Visual feedback: checkmark icon + success tooltip
 - Auto-reset: returns to original state after delay
 - Clipboard API: native browser copy functionality

data/assets/js/base/backtotop.js

@@ -2,7 +2,11 @@
 // Reads configuration from data attributes on this script tag
 // Applied via backtotop.html.liquid template with data attributes
 
-(function () {
+// This script tag lives in <head>, before <body> exists. defer normally
+// delays execution until after parsing, but consumers that inline this
+// file (e.g. monolith bundling) drop the src that defer depends on, so the
+// wait for DOMContentLoaded is done explicitly instead of relying on it.
+document.addEventListener('DOMContentLoaded', () => {
   const scriptTag = document.getElementById('centos-backtop')
 
   if (!scriptTag) {
@@ -17,4 +21,4 @@
   }
 
   addBackToTop(config)
-})()
+})

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-theme-centos
 version: !ruby/object:Gem::Version
-  version: 2.52.0.beta.78
+  version: 2.52.0.beta.79
 platform: ruby
 authors:
 - Alain Reguera Delgado