Skip to content

change: some changes related to security. #286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
liwang2019 wants to merge 6 commits into
base: master
Choose a base branch
from
Open

change: some changes related to security. #286

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
826f59e
change: sanitize markdown-rendered HTML against stored XSS.
liwang2019 Aug 25, 2026
7a3b78c
change: add SRI to self-hosted vendor scripts.
liwang2019 Aug 25, 2026
2286d2f
change: add rel="noopener noreferrer" to external news links.
liwang2019 Aug 25, 2026
14c42f4
change: consistently HTML-escape template fields.
liwang2019 Aug 25, 2026
8e22bac
change: restrict the blog modal iframe to OpenResty blog origins.
liwang2019 Aug 26, 2026
83da3a6
change: polish the blog post modal.
liwang2019 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 56 additions & 12 deletions v2/css/main.css
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -938,35 +938,79 @@ hr.footer-sep {
vertical-align: top;
}
.blog-iframe {
display: block;
width: 100%;
height: 100%;
border: 0;
}
.blog-modal {
box-sizing: border-box;
width: 90%;
height: 85%;
padding: 15px 30px;
width: min(1500px, calc(100vw - 48px));
max-width: none;
height: calc(100vh - 48px);
max-height: none;
margin: 24px auto;
padding: 0;
border: 0;
border-radius: 8px;
box-shadow: 0 0 10px #000;
border-radius: 12px;
overflow: hidden;
box-shadow: 0 20px 60px rgba(0, 0, 0, 0.45);
}
.blog-modal-loading {
position: absolute;
top: 0;
left: 0;
right: 0;
bottom: 0;
display: none;
align-items: center;
justify-content: center;
background: #fff;
z-index: 1;
}
.blog-modal.is-loading .blog-modal-loading {
display: flex;
}
.blog-modal-spinner {
width: 44px;
height: 44px;
border: 3px solid rgba(0, 0, 0, 0.08);
border-top-color: #2b5fd9;
border-radius: 50%;
animation: blog-modal-spin 0.8s linear infinite;
}
@keyframes blog-modal-spin {
to {
transform: rotate(360deg);
}
}
.blog-modal::backdrop {
background: rgba(0, 0, 0, 0.75);
}
.blog-modal-close {
position: absolute;
top: 4px;
right: 8px;
top: 20px;
right: 28px;
width: 40px;
height: 40px;
padding: 0;
border: 0;
background: transparent;
color: #333;
border-radius: 50%;
background: rgba(0, 0, 0, 0.06);
color: #444;
cursor: pointer;
font-size: 30px;
line-height: 1;
font-size: 24px;
line-height: 40px;
text-align: center;
transition: background 0.15s, color 0.15s;
z-index: 2;
}
.blog-modal-close:hover {
background: rgba(0, 0, 0, 0.12);
color: #000;
}
.blog-modal-close:focus-visible {
outline: 2px solid #4d8d89;
outline: 2px solid #2b5fd9;
outline-offset: 2px;
}
/*=====================================================================================
Expand Down
71 changes: 59 additions & 12 deletions v2/css/main.less
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -444,18 +444,54 @@ hr.footer-sep {
}

.blog-iframe {
display: block;
width: 100%;
height: 100%;
border: 0;
}

.blog-modal {
box-sizing: border-box;
width: 90%;
height: 85%;
padding: 15px 30px;
width: min(1500px, calc(100vw - 48px));
max-width: none;
height: calc(100vh - 48px);
max-height: none;
margin: 24px auto;
padding: 0;
border: 0;
border-radius: 8px;
box-shadow: 0 0 10px #000;
border-radius: 12px;
overflow: hidden;
box-shadow: 0 20px 60px rgba(0, 0, 0, 0.45);
}

.blog-modal-loading {
position: absolute;
top: 0;
left: 0;
right: 0;
bottom: 0;
display: none;
align-items: center;
justify-content: center;
background: #fff;
z-index: 1;
}

.blog-modal.is-loading .blog-modal-loading {
display: flex;
}

.blog-modal-spinner {
width: 44px;
height: 44px;
border: 3px solid rgba(0, 0, 0, 0.08);
border-top-color: #2b5fd9;
border-radius: 50%;
animation: blog-modal-spin 0.8s linear infinite;
}

@keyframes blog-modal-spin {
to { transform: rotate(360deg); }
}

.blog-modal::backdrop {
Expand All @@ -464,19 +500,30 @@ hr.footer-sep {

.blog-modal-close {
position: absolute;
top: 4px;
right: 8px;
top: 20px;
right: 28px;
width: 40px;
height: 40px;
padding: 0;
border: 0;
background: transparent;
color: #333;
border-radius: 50%;
background: rgba(0, 0, 0, 0.06);
color: #444;
cursor: pointer;
font-size: 30px;
line-height: 1;
font-size: 24px;
line-height: 40px;
text-align: center;
transition: background 0.15s, color 0.15s;
z-index: 2;
}

.blog-modal-close:hover {
background: rgba(0, 0, 0, 0.12);
color: #000;
}

.blog-modal-close:focus-visible {
outline: 2px solid @link;
outline: 2px solid #2b5fd9;
outline-offset: 2px;
}

Expand Down
16 changes: 0 additions & 16 deletions v2/js/less.js
View file
Open in desktop

This file was deleted.

33 changes: 31 additions & 2 deletions v2/js/main.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,33 @@ $(document).ready(function() {

var blogModal = document.getElementById('blog-modal');
var blogIframe = document.getElementById('blog-iframe');
var blogLoading = document.getElementById('blog-modal-loading');

// Only allow the OpenResty blog origins to be embedded in the modal
// iframe; a compromised or hijacked RSS feed must not be able to load
// an arbitrary third-party page here (clickjacking / phishing).
var allowedIframeHosts = ['blog.openresty.com', 'blog.openresty.com.cn'];

function isAllowedIframeUrl(url) {
try {
var host = new URL(url, window.location.origin).hostname;
return allowedIframeHosts.indexOf(host) !== -1;
} catch (e) {
return false;
}
}

if (blogModal && blogIframe) {
$('.article-item').on('click', function (event) {
event.preventDefault();
blogIframe.src = $(this).attr('href');
blogModal.showModal();
var href = $(this).attr('href');
if (isAllowedIframeUrl(href)) {
blogModal.classList.add('is-loading');
blogIframe.src = href;
blogModal.showModal();
// keep the focus ring off the close button on open
blogIframe.focus();
}
});

$('.blog-modal-close').on('click', function () {
Expand All @@ -55,8 +76,16 @@ $(document).ready(function() {
}
});

blogIframe.addEventListener('load', function () {
// ignore the load fired when src is cleared on close
if (blogIframe.getAttribute('src')) {
blogModal.classList.remove('is-loading');
}
});

blogModal.addEventListener('close', function () {
blogIframe.src = '';
blogModal.classList.remove('is-loading');
});
}
});
Expand Down
15 changes: 15 additions & 0 deletions v2/lua/openresty_org/model.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,18 @@ function _M.get_timeline(lang)
return res
end

-- Escape HTML in a ts_headline result but preserve the <b>/</b> highlight
-- markers Postgres inserts around matched terms. Any other markup is escaped
-- so it renders as plain text instead of being interpreted as HTML.
local function escape_html_keep_b(s)
s = s:gsub("&", "&amp;")
s = s:gsub("<", "&lt;")
s = s:gsub(">", "&gt;")
s = s:gsub("&lt;b&gt;", "<b>")
s = s:gsub("&lt;/b&gt;", "</b>")
return s
end

function _M.get_search_results(lang, query)
-- print("search query: ", query)
local quoted_query = quote_sql_str(query)
Expand All @@ -138,6 +150,9 @@ function _M.get_search_results(lang, query)
.. quoted_query .. ") q "
.. "where textsearch_index_col @@ q "
.. "order by rank desc limit 10) as foo")
for _, row in ipairs(res) do
row.body = escape_html_keep_b(row.body)
end
return res
end

Expand Down
Loading