Skip to content

Commit e9b4abb

Browse files
gjtorikiangjtorikian
authored
Merge pull request #529 from gjtorikian/blacklist-stylesheet-links
Check only stylesheet link rels rather than whitelisting other rels
2 parents bf2c9a6 + b345cdc commit e9b4abb

File tree

5 files changed

+232
-2
lines changed

5 files changed

+232
-2
lines changed

‎lib/html-proofer/check/links.rb

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,10 +129,12 @@ def find_fragments(html, fragment_ids)
129129
html.xpath(*xpaths)
130130
end
131131

132-
IGNORABE_REL = %(canonical alternate next prev previous icon manifest apple-touch-icon)
132+
# Whitelist for affected elements from Subresource Integrity specification
133+
# https://w3c.github.io/webappsec-subresource-integrity/#link-element-for-stylesheets
134+
SRI_REL_TYPES = %(stylesheet)
133135

134136
def check_sri(line, content)
135-
return if IGNORABE_REL.include?(@link.rel)
137+
return unless SRI_REL_TYPES.include?(@link.rel)
136138
if !defined?(@link.integrity) && !defined?(@link.crossorigin)
137139
add_issue("SRI and CORS not provided in: #{@link.src}", line: line, content: content)
138140
elsif !defined?(@link.integrity)

‎spec/html-proofer/fixtures/links/link_with_me.html

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<html>
2+
<head>
3+
<link rel="me" href="https://github.com/gjtorikian/html-proofer" />
4+
<link rel="webmention" href="https://webmention.io/username/webmention" />
5+
<link rel="pingback" href="https://webmention.io/username/xmlrpc" />
6+
</head>
7+
<body></body>
8+
</html>

‎spec/html-proofer/fixtures/vcr_cassettes/links/link_with_me_html_check_sri_true_log_level_error_type_file_.yml

Lines changed: 162 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎spec/html-proofer/fixtures/vcr_cassettes/links/redirected_error_html_log_level_error_type_file_.yml

Lines changed: 52 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎spec/html-proofer/links_spec.rb

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -609,6 +609,12 @@
609609
expect(proofer.failed_tests).to eq []
610610
end
611611

612+
it 'is not checking SRI and CORS for indieweb links with rel "me", "webmention", or "pingback"' do
613+
file = "#{FIXTURES_DIR}/links/link_with_me.html"
614+
proofer = run_proofer(file, :file, check_sri: true)
615+
expect(proofer.failed_tests).to eq []
616+
end
617+
612618
it 'can link to external non-unicode hash' do
613619
file = "#{FIXTURES_DIR}/links/hash_to_unicode_ref.html"
614620
proofer = run_proofer(file, :file, check_external_hash: true)

0 commit comments

Comments
 (0)