fix(csp): drop unsafe-inline from style-src

Author: bhdicaire

assets/css/chroma.css

@@ -0,0 +1,86 @@
+/* Background */ .bg { background-color: #ffffff; }
+/* PreWrapper */ .chroma { background-color: #ffffff; }
+/* Other */ .chroma .x {  }
+/* Error */ .chroma .err { color: #a61717; background-color: #e3d2d2 }
+/* CodeLine */ .chroma .cl {  }
+/* LineLink */ .chroma .lnlinks { outline: none; text-decoration: none; color: inherit }
+/* LineTableTD */ .chroma .lntd { vertical-align: top; padding: 0; margin: 0; border: 0; }
+/* LineTable */ .chroma .lntable { border-spacing: 0; padding: 0; margin: 0; border: 0; }
+/* LineHighlight */ .chroma .hl { background-color: #e5e5e5 }
+/* LineNumbersTable */ .chroma .lnt { white-space: pre; -webkit-user-select: none; user-select: none; margin-right: 0.4em; padding: 0 0.4em 0 0.4em;color: #7f7f7f }
+/* LineNumbers */ .chroma .ln { white-space: pre; -webkit-user-select: none; user-select: none; margin-right: 0.4em; padding: 0 0.4em 0 0.4em;color: #7f7f7f }
+/* Line */ .chroma .line { display: flex; }
+/* Keyword */ .chroma .k { color: #000000; font-weight: bold }
+/* KeywordConstant */ .chroma .kc { color: #000000; font-weight: bold }
+/* KeywordDeclaration */ .chroma .kd { color: #000000; font-weight: bold }
+/* KeywordNamespace */ .chroma .kn { color: #000000; font-weight: bold }
+/* KeywordPseudo */ .chroma .kp { color: #000000; font-weight: bold }
+/* KeywordReserved */ .chroma .kr { color: #000000; font-weight: bold }
+/* KeywordType */ .chroma .kt { color: #445588; font-weight: bold }
+/* Name */ .chroma .n {  }
+/* NameAttribute */ .chroma .na { color: #008080 }
+/* NameBuiltin */ .chroma .nb { color: #0086b3 }
+/* NameBuiltinPseudo */ .chroma .bp { color: #999999 }
+/* NameClass */ .chroma .nc { color: #445588; font-weight: bold }
+/* NameConstant */ .chroma .no { color: #008080 }
+/* NameDecorator */ .chroma .nd { color: #3c5d5d; font-weight: bold }
+/* NameEntity */ .chroma .ni { color: #800080 }
+/* NameException */ .chroma .ne { color: #990000; font-weight: bold }
+/* NameFunction */ .chroma .nf { color: #990000; font-weight: bold }
+/* NameFunctionMagic */ .chroma .fm {  }
+/* NameLabel */ .chroma .nl { color: #990000; font-weight: bold }
+/* NameNamespace */ .chroma .nn { color: #555555 }
+/* NameOther */ .chroma .nx {  }
+/* NameProperty */ .chroma .py {  }
+/* NameTag */ .chroma .nt { color: #000080 }
+/* NameVariable */ .chroma .nv { color: #008080 }
+/* NameVariableClass */ .chroma .vc { color: #008080 }
+/* NameVariableGlobal */ .chroma .vg { color: #008080 }
+/* NameVariableInstance */ .chroma .vi { color: #008080 }
+/* NameVariableMagic */ .chroma .vm {  }
+/* Literal */ .chroma .l {  }
+/* LiteralDate */ .chroma .ld {  }
+/* LiteralString */ .chroma .s { color: #dd1144 }
+/* LiteralStringAffix */ .chroma .sa { color: #dd1144 }
+/* LiteralStringBacktick */ .chroma .sb { color: #dd1144 }
+/* LiteralStringChar */ .chroma .sc { color: #dd1144 }
+/* LiteralStringDelimiter */ .chroma .dl { color: #dd1144 }
+/* LiteralStringDoc */ .chroma .sd { color: #dd1144 }
+/* LiteralStringDouble */ .chroma .s2 { color: #dd1144 }
+/* LiteralStringEscape */ .chroma .se { color: #dd1144 }
+/* LiteralStringHeredoc */ .chroma .sh { color: #dd1144 }
+/* LiteralStringInterpol */ .chroma .si { color: #dd1144 }
+/* LiteralStringOther */ .chroma .sx { color: #dd1144 }
+/* LiteralStringRegex */ .chroma .sr { color: #009926 }
+/* LiteralStringSingle */ .chroma .s1 { color: #dd1144 }
+/* LiteralStringSymbol */ .chroma .ss { color: #990073 }
+/* LiteralNumber */ .chroma .m { color: #009999 }
+/* LiteralNumberBin */ .chroma .mb { color: #009999 }
+/* LiteralNumberFloat */ .chroma .mf { color: #009999 }
+/* LiteralNumberHex */ .chroma .mh { color: #009999 }
+/* LiteralNumberInteger */ .chroma .mi { color: #009999 }
+/* LiteralNumberIntegerLong */ .chroma .il { color: #009999 }
+/* LiteralNumberOct */ .chroma .mo { color: #009999 }
+/* Operator */ .chroma .o { color: #000000; font-weight: bold }
+/* OperatorWord */ .chroma .ow { color: #000000; font-weight: bold }
+/* Punctuation */ .chroma .p {  }
+/* Comment */ .chroma .c { color: #999988; font-style: italic }
+/* CommentHashbang */ .chroma .ch { color: #999988; font-style: italic }
+/* CommentMultiline */ .chroma .cm { color: #999988; font-style: italic }
+/* CommentSingle */ .chroma .c1 { color: #999988; font-style: italic }
+/* CommentSpecial */ .chroma .cs { color: #999999; font-weight: bold; font-style: italic }
+/* CommentPreproc */ .chroma .cp { color: #999999; font-weight: bold; font-style: italic }
+/* CommentPreprocFile */ .chroma .cpf { color: #999999; font-weight: bold; font-style: italic }
+/* Generic */ .chroma .g {  }
+/* GenericDeleted */ .chroma .gd { color: #000000; background-color: #ffdddd }
+/* GenericEmph */ .chroma .ge { color: #000000; font-style: italic }
+/* GenericError */ .chroma .gr { color: #aa0000 }
+/* GenericHeading */ .chroma .gh { color: #999999 }
+/* GenericInserted */ .chroma .gi { color: #000000; background-color: #ddffdd }
+/* GenericOutput */ .chroma .go { color: #888888 }
+/* GenericPrompt */ .chroma .gp { color: #555555 }
+/* GenericStrong */ .chroma .gs { font-weight: bold }
+/* GenericSubheading */ .chroma .gu { color: #aaaaaa }
+/* GenericTraceback */ .chroma .gt { color: #aa0000 }
+/* GenericUnderline */ .chroma .gl { text-decoration: underline }
+/* TextWhitespace */ .chroma .w { color: #bbbbbb }

assets/css/main.css

@@ -36,12 +36,32 @@
 @tailwind components;
 @tailwind utilities;
 
+/* Chroma syntax highlighting — class-based output so CSP can drop
+ * 'unsafe-inline' from style-src. Generated from `hugo gen chromastyles
+ * --style=github`. To change theme, regenerate with a different style name. */
+@import "chroma.css";
+
 @layer base {
   html { scroll-behavior: smooth; }
   body { -webkit-font-smoothing: antialiased; }
 }
 
 @layer components {
+  /* ── Utility classes replacing inline style="..." attributes ──
+   * Added so we can drop 'unsafe-inline' from the style-src CSP directive. */
+  .hero-grid-bg {
+    background-image:
+      linear-gradient(rgba(255, 255, 255, 0.08) 1px, transparent 1px),
+      linear-gradient(90deg, rgba(255, 255, 255, 0.08) 1px, transparent 1px);
+    background-size: 32px 32px;
+  }
+
+  .reading-progress {
+    /* Initial width; JS updates element.style.width on scroll (JS-set styles
+     * bypass style-src CSP, unlike HTML style="..." attributes). */
+    width: 0;
+  }
+
   /* ── Navigation ── */
   .nav-link {
     @apply text-sm font-medium text-gray-600 hover:text-gray-900

assets/css/showcase-colors.css

@@ -0,0 +1,13 @@
+{{/* Generated per-slug showcase colors — avoids inline style="background: ..."
+     so CSP can drop 'unsafe-inline' from style-src.
+
+     Matches the [data-slug="..."] attribute rendered by
+     layouts/showcase/{list,single}.html. */}}
+
+{{ range where .Site.RegularPages "Section" "showcase" }}
+  {{- /* Use File.ContentBaseName so "bhdicaire-com.en.md" and
+        "bhdicaire-com.fr.md" share a slug and a color rule */ -}}
+  {{ $slug  := .File.ContentBaseName }}
+  {{ $color := .Params.color | default "#0369a1" }}
+.showcase-logo[data-slug="{{ $slug }}"] { background: {{ $color }}; }
+{{ end -}}

assets/js/app.js

@@ -220,9 +220,25 @@
       showMsg((t.search_no_results || 'No results for "%s"').replace('%s', q));
       return;
     }
+
+    // Pagefind returns every result whose index chunks contain ANY partial match,
+    // ranked by relevance. For foreign words or typos, this produces noisy fuzzy
+    // hits with very low scores. Filter to results the user would actually care
+    // about. Empirically, Pagefind scores above ~0.5 are meaningful matches;
+    // below that is mostly incidental term-overlap noise.
+    var MIN_SCORE = 0.5;
+    var filtered = results.filter(function (r) {
+      return typeof r.score !== 'number' || r.score >= MIN_SCORE;
+    });
+
+    if (!filtered.length) {
+      showMsg((t.search_no_results || 'No results for "%s"').replace('%s', q));
+      return;
+    }
+
     if (searchPlaceholder) searchPlaceholder.classList.add('hidden');
 
-    Promise.all(results.slice(0, 8).map(function (r) { return r.data(); }))
+    Promise.all(filtered.slice(0, 8).map(function (r) { return r.data(); }))
       .then(function (items) {
         items.forEach(function (item) {
           var a = document.createElement('a');

content/security.en.md

@@ -57,7 +57,7 @@ Every response from vanityURLs.link includes the following headers, defined in `
 ```
 default-src 'self';
 script-src  'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net;
-style-src   'self' 'unsafe-inline';
+style-src   'self';
 font-src    'self';
 img-src     'self' data:;
 connect-src 'self';

content/security.fr.md

@@ -36,7 +36,7 @@ Chaque réponse de vanityURLs.link inclut les en-têtes suivants, définis dans
 ```
 default-src 'self';
 script-src  'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net;
-style-src   'self' 'unsafe-inline';
+style-src   'self';
 font-src    'self';
 img-src     'self' data:;
 connect-src 'self';

hugo.yml

@@ -133,7 +133,7 @@ markup:
     style: "github"
     lineNos: false
     tabWidth: 2
-    noClasses: true
+    noClasses: false
   goldmark:
     renderer:
       unsafe: true

layouts/blog/single.html

@@ -19,8 +19,7 @@
 
 <!-- Reading progress bar -->
 <div id="reading-progress"
-     class="fixed top-0 left-0 h-0.5 bg-brand-500 dark:bg-brand-400 z-50 transition-none"
-     style="width:0%"></div>
+     class="reading-progress fixed top-0 left-0 h-0.5 bg-brand-500 dark:bg-brand-400 z-50 transition-none"></div>
 
 <article class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-12">
 

layouts/index.html

@@ -6,8 +6,7 @@
 
 <!-- ═══════ HERO ═══════ -->
 <section class="relative overflow-hidden bg-gradient-to-br from-gray-900 via-brand-900 to-gray-900 text-white">
-  <div class="absolute inset-0 opacity-10"
-       style="background-image: linear-gradient(rgba(255,255,255,.08) 1px, transparent 1px), linear-gradient(90deg, rgba(255,255,255,.08) 1px, transparent 1px); background-size: 32px 32px;"></div>
+  <div class="absolute inset-0 opacity-10 hero-grid-bg"></div>
   <div class="relative max-w-6xl mx-auto px-4 sm:px-6 lg:px-8 py-20 md:py-28">
     <div class="flex flex-col items-center text-center">
 

layouts/partials/head.html

@@ -65,6 +65,14 @@
 {{ $css  := resources.Get "css/main.css" | css.PostCSS $opts | resources.Minify | resources.Fingerprint }}
 <link rel="stylesheet" href="{{ $css.RelPermalink }}" integrity="{{ $css.Data.Integrity }}">
 
+{{/* Per-showcase-item color rules — generated from frontmatter so we don't
+     need inline style="background: ..." (which style-src CSP would block).
+     Only emit the stylesheet on pages where showcase cards actually render. */}}
+{{ if or (eq .Section "showcase") .IsHome }}
+{{ $showcase := resources.Get "css/showcase-colors.css" | resources.ExecuteAsTemplate "css/showcase-colors.css" . | resources.Minify | resources.Fingerprint }}
+<link rel="stylesheet" href="{{ $showcase.RelPermalink }}" integrity="{{ $showcase.Data.Integrity }}">
+{{ end }}
+
 {{/* ── Fonts ──────────────────────────────────────────────────
      Self-hosted from /fonts/ (see @font-face declarations in assets/css/main.css).
      Preload the upright weights that body text needs immediately; italic + mono can load lazily.