From f6b5f2c02137c9e3cd94f67f16c518cf67def566 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 12:19:39 -0400 Subject: [PATCH 01/18] testing CSP header --- package-lock.json | 4 ++-- src/main.js | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index e46b57000..1b5d53625 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "college-scorecard", - "version": "2.10", + "version": "2.10.0", "lockfileVersion": 2, "requires": true, "packages": { "": { "name": "college-scorecard", - "version": "2.10", + "version": "2.10.0", "dependencies": { "@fortawesome/fontawesome-free": "^5.15.3", "@mdi/font": "^5.9.55", diff --git a/src/main.js b/src/main.js index 71c582a57..af1ac3cf8 100644 --- a/src/main.js +++ b/src/main.js @@ -151,6 +151,10 @@ export default function (Vue, { router, head, isClient, appOptions }) { }) //Twitter and OpenGraph + head.meta.push({ + 'http-equiv':'Content-Security-Policy', + content: "default-src 'self'; img-src https://*; child-src 'none';" + }) head.meta.push({ name: 'og:type', content: 'website' From dcde2dbed318dc315d41a9ae14c59a3e374a6f64 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 12:51:23 -0400 Subject: [PATCH 02/18] CSP headers set --- package-lock.json | 707 ++++++++++++++++++++++++++++------------------ package.json | 1 - src/main.js | 2 +- 3 files changed, 436 insertions(+), 274 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1b5d53625..78ae2d3de 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5072,14 +5072,6 @@ "node": ">=8" } }, - "node_modules/detect-libc": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.1.tgz", - "integrity": "sha512-463v3ZeIrcWtdgIg6vI6XUncguvr2TnGl4SzDXinkt9mSLpBJKXT3mW6xT3VQdDN11+WVs29pgvivTc4Lp8v+w==", - "engines": { - "node": ">=8" - } - }, "node_modules/detect-newline": { "version": "3.1.0", "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz", @@ -6435,6 +6427,17 @@ "node": ">=6 <7 || >=8" } }, + "node_modules/fs-minipass": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz", + "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==", + "dependencies": { + "minipass": "^3.0.0" + }, + "engines": { + "node": ">= 8" + } + }, "node_modules/fs-write-stream-atomic": { "version": "1.0.10", "resolved": "https://registry.npmjs.org/fs-write-stream-atomic/-/fs-write-stream-atomic-1.0.10.tgz", @@ -6872,6 +6875,151 @@ "node": ">=8.3" } }, + "node_modules/gridsome/node_modules/decompress-response": { + "version": "4.2.1", + "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-4.2.1.tgz", + "integrity": "sha512-jOSne2qbyE+/r8G1VU+G/82LBs2Fs4LAsTiLSHOCOMZQl2OKZ6i8i4IyHemTe+/yIXOtTcRQMzPcgyhoFlqPkw==", + "dependencies": { + "mimic-response": "^2.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/gridsome/node_modules/detect-libc": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz", + "integrity": "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==", + "bin": { + "detect-libc": "bin/detect-libc.js" + }, + "engines": { + "node": ">=0.10" + } + }, + "node_modules/gridsome/node_modules/mimic-response": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-2.1.0.tgz", + "integrity": "sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA==", + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/gridsome/node_modules/node-abi": { + "version": "2.30.1", + "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-2.30.1.tgz", + "integrity": "sha512-/2D0wOQPgaUWzVSVgRMx+trKJRC2UG4SUc4oCJoXx9Uxjtp0Vy3/kt7zcbxHF8+Z/pK3UloLWzBISg72brfy1w==", + "dependencies": { + "semver": "^5.4.1" + } + }, + "node_modules/gridsome/node_modules/node-abi/node_modules/semver": { + "version": "5.7.1", + "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz", + "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==", + "bin": { + "semver": "bin/semver" + } + }, + "node_modules/gridsome/node_modules/node-addon-api": { + "version": "3.2.1", + "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.2.1.tgz", + "integrity": "sha512-mmcei9JghVNDYydghQmeDX8KoAm0FAiYyIcUt/N4nhyAipB17pllZQDOJD2fotxABnt4Mdz+dKTO7eftLg4d0A==" + }, + "node_modules/gridsome/node_modules/prebuild-install": { + "version": "5.3.6", + "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-5.3.6.tgz", + "integrity": "sha512-s8Aai8++QQGi4sSbs/M1Qku62PFK49Jm1CbgXklGz4nmHveDq0wzJkg7Na5QbnO1uNH8K7iqx2EQ/mV0MZEmOg==", + "dependencies": { + "detect-libc": "^1.0.3", + "expand-template": "^2.0.3", + "github-from-package": "0.0.0", + "minimist": "^1.2.3", + "mkdirp-classic": "^0.5.3", + "napi-build-utils": "^1.0.1", + "node-abi": "^2.7.0", + "noop-logger": "^0.1.1", + "npmlog": "^4.0.1", + "pump": "^3.0.0", + "rc": "^1.2.7", + "simple-get": "^3.0.3", + "tar-fs": "^2.0.0", + "tunnel-agent": "^0.6.0", + "which-pm-runs": "^1.0.0" + }, + "bin": { + "prebuild-install": "bin.js" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/gridsome/node_modules/prebuild-install/node_modules/simple-get": { + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-3.1.1.tgz", + "integrity": "sha512-CQ5LTKGfCpvE1K0n2us+kuMPbk/q0EKl82s4aheV9oXjFEz6W/Y7oQFVJuU6QG77hRT4Ghb5RURteF5vnWjupA==", + "dependencies": { + "decompress-response": "^4.2.0", + "once": "^1.3.1", + "simple-concat": "^1.0.0" + } + }, + "node_modules/gridsome/node_modules/semver": { + "version": "7.3.8", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz", + "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/gridsome/node_modules/semver/node_modules/lru-cache": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", + "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/gridsome/node_modules/sharp": { + "version": "0.25.4", + "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.25.4.tgz", + "integrity": "sha512-umSzJJ1oBwIOfwFFt/fJ7JgCva9FvrEU2cbbm7u/3hSDZhXvkME8WE5qpaJqLIe2Har5msF5UG4CzYlEg5o3BQ==", + "hasInstallScript": true, + "dependencies": { + "color": "^3.1.2", + "detect-libc": "^1.0.3", + "node-addon-api": "^3.0.0", + "npmlog": "^4.1.2", + "prebuild-install": "^5.3.4", + "semver": "^7.3.2", + "simple-get": "^4.0.0", + "tar": "^6.0.2", + "tunnel-agent": "^0.6.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://opencollective.com/libvips" + } + }, + "node_modules/gridsome/node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + }, "node_modules/har-schema": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/har-schema/-/har-schema-2.0.0.tgz", @@ -8973,6 +9121,39 @@ "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz", "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==" }, + "node_modules/minipass": { + "version": "3.3.4", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.4.tgz", + "integrity": "sha512-I9WPbWHCGu8W+6k1ZiGpPu0GkoKBeorkfKNuAFBNS1HNFJvke82sxvI5bzcCNpWPorkOO5QQ+zomzzwRxejXiw==", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/minipass/node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + }, + "node_modules/minizlib": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz", + "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==", + "dependencies": { + "minipass": "^3.0.0", + "yallist": "^4.0.0" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/minizlib/node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + }, "node_modules/mississippi": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/mississippi/-/mississippi-3.0.0.tgz", @@ -9163,52 +9344,6 @@ "lower-case": "^1.1.1" } }, - "node_modules/node-abi": { - "version": "3.22.0", - "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.22.0.tgz", - "integrity": "sha512-u4uAs/4Zzmp/jjsD9cyFYDXeISfUWaAVWshPmDZOFOv4Xl4SbzTXm53I04C2uRueYJ+0t5PEtLH/owbn2Npf/w==", - "dependencies": { - "semver": "^7.3.5" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/node-abi/node_modules/lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "dependencies": { - "yallist": "^4.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/node-abi/node_modules/semver": { - "version": "7.3.7", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz", - "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==", - "dependencies": { - "lru-cache": "^6.0.0" - }, - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/node-abi/node_modules/yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" - }, - "node_modules/node-addon-api": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-5.0.0.tgz", - "integrity": "sha512-CvkDw2OEnme7ybCykJpVcKH+uAOLV2qLqiyla128dN9TkEWfrYmxG6C2boDe5KcNQqZF3orkqzGgOMvZ/JNekA==" - }, "node_modules/node-libs-browser": { "version": "2.2.1", "resolved": "https://registry.npmjs.org/node-libs-browser/-/node-libs-browser-2.2.1.tgz", @@ -9259,6 +9394,11 @@ "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.4.tgz", "integrity": "sha512-gbMzqQtTtDz/00jQzZ21PQzdI9PyLYqUSvD0p3naOhX4odFji0ZxYdnVwPTxmSwkmxhcFImpozceidSG+AgoPQ==" }, + "node_modules/noop-logger": { + "version": "0.1.1", + "resolved": "https://registry.npmjs.org/noop-logger/-/noop-logger-0.1.1.tgz", + "integrity": "sha512-6kM8CLXvuW5crTxsAtva2YLrRrDaiTIkIePWs9moLHqbFWT94WpNFjwS/5dfLfECg5i/lkmw3aoqVidxt23TEQ==" + }, "node_modules/normalize-package-data": { "version": "2.5.0", "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz", @@ -10849,32 +10989,6 @@ "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz", "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==" }, - "node_modules/prebuild-install": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.0.tgz", - "integrity": "sha512-CNcMgI1xBypOyGqjp3wOc8AAo1nMhZS3Cwd3iHIxOdAUbb+YxdNuM4Z5iIrZ8RLvOsf3F3bl7b7xGq6DjQoNYA==", - "dependencies": { - "detect-libc": "^2.0.0", - "expand-template": "^2.0.3", - "github-from-package": "0.0.0", - "minimist": "^1.2.3", - "mkdirp-classic": "^0.5.3", - "napi-build-utils": "^1.0.1", - "node-abi": "^3.3.0", - "npmlog": "^4.0.1", - "pump": "^3.0.0", - "rc": "^1.2.7", - "simple-get": "^4.0.0", - "tar-fs": "^2.0.0", - "tunnel-agent": "^0.6.0" - }, - "bin": { - "prebuild-install": "bin.js" - }, - "engines": { - "node": ">=10" - } - }, "node_modules/prepend-http": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/prepend-http/-/prepend-http-2.0.0.tgz", @@ -12091,81 +12205,6 @@ "sha.js": "bin.js" } }, - "node_modules/sharp": { - "version": "0.30.6", - "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.30.6.tgz", - "integrity": "sha512-lSdVxFxcndzcXggDrak6ozdGJgmIgES9YVZWtAFrwi+a/H5vModaf51TghBtMPw+71sLxUsTy2j+aB7qLIODQg==", - "hasInstallScript": true, - "dependencies": { - "color": "^4.2.3", - "detect-libc": "^2.0.1", - "node-addon-api": "^5.0.0", - "prebuild-install": "^7.1.0", - "semver": "^7.3.7", - "simple-get": "^4.0.1", - "tar-fs": "^2.1.1", - "tunnel-agent": "^0.6.0" - }, - "engines": { - "node": ">=12.13.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/sharp/node_modules/color": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/color/-/color-4.2.3.tgz", - "integrity": "sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==", - "dependencies": { - "color-convert": "^2.0.1", - "color-string": "^1.9.0" - }, - "engines": { - "node": ">=12.5.0" - } - }, - "node_modules/sharp/node_modules/color-convert": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", - "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", - "dependencies": { - "color-name": "~1.1.4" - }, - "engines": { - "node": ">=7.0.0" - } - }, - "node_modules/sharp/node_modules/lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "dependencies": { - "yallist": "^4.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/sharp/node_modules/semver": { - "version": "7.3.7", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz", - "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==", - "dependencies": { - "lru-cache": "^6.0.0" - }, - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/sharp/node_modules/yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" - }, "node_modules/shebang-command": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz", @@ -13277,6 +13316,22 @@ "node": ">=6" } }, + "node_modules/tar": { + "version": "6.1.11", + "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.11.tgz", + "integrity": "sha512-an/KZQzQUkZCkuoAA64hM92X0Urb6VpRhAFllDzz44U2mcD5scmT3zBc4VgVpkugF580+DQn8eAFSyoQt0tznA==", + "dependencies": { + "chownr": "^2.0.0", + "fs-minipass": "^2.0.0", + "minipass": "^3.0.0", + "minizlib": "^2.1.1", + "mkdirp": "^1.0.3", + "yallist": "^4.0.0" + }, + "engines": { + "node": ">= 10" + } + }, "node_modules/tar-fs": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz", @@ -13343,6 +13398,30 @@ "node": ">= 0.8.0" } }, + "node_modules/tar/node_modules/chownr": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz", + "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==", + "engines": { + "node": ">=10" + } + }, + "node_modules/tar/node_modules/mkdirp": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz", + "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==", + "bin": { + "mkdirp": "bin/cmd.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/tar/node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + }, "node_modules/temp-dir": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/temp-dir/-/temp-dir-1.0.0.tgz", @@ -14770,6 +14849,14 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/which-pm-runs": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/which-pm-runs/-/which-pm-runs-1.1.0.tgz", + "integrity": "sha512-n1brCuqClxfFfq/Rb0ICg9giSZqCS+pLtccdag6C2HyufBrh3fBOiy9nb6ggRMvWOVH5GrdJskj5iGTZNxd7SA==", + "engines": { + "node": ">=4" + } + }, "node_modules/wide-align": { "version": "1.1.5", "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.5.tgz", @@ -18785,11 +18872,6 @@ "resolved": "https://registry.npmjs.org/detect-indent/-/detect-indent-6.1.0.tgz", "integrity": "sha512-reYkTUJAZb9gUuZ2RvVCNhVHdg62RHnJ7WJl8ftMi4diZ6NWlciOzQN88pUhSELEwflJht4oQDv0F0BMlwaYtA==" }, - "detect-libc": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.1.tgz", - "integrity": "sha512-463v3ZeIrcWtdgIg6vI6XUncguvr2TnGl4SzDXinkt9mSLpBJKXT3mW6xT3VQdDN11+WVs29pgvivTc4Lp8v+w==" - }, "detect-newline": { "version": "3.1.0", "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz", @@ -19849,6 +19931,14 @@ "universalify": "^0.1.0" } }, + "fs-minipass": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz", + "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==", + "requires": { + "minipass": "^3.0.0" + } + }, "fs-write-stream-atomic": { "version": "1.0.10", "resolved": "https://registry.npmjs.org/fs-write-stream-atomic/-/fs-write-stream-atomic-1.0.10.tgz", @@ -20183,7 +20273,7 @@ "portfinder": "^1.0.20", "postcss-loader": "^3.0.0", "probe-image-size": "^4.0.0", - "sharp": "^0.30.5", + "sharp": "^0.25.2", "slash": "^2.0.0", "sockjs": "^0.3.19", "sockjs-client": "^1.3.0", @@ -20202,6 +20292,119 @@ "webpack-hot-middleware": "^2.24.3", "webpack-merge": "^4.2.1", "yaml-loader": "^0.5.0" + }, + "dependencies": { + "decompress-response": { + "version": "4.2.1", + "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-4.2.1.tgz", + "integrity": "sha512-jOSne2qbyE+/r8G1VU+G/82LBs2Fs4LAsTiLSHOCOMZQl2OKZ6i8i4IyHemTe+/yIXOtTcRQMzPcgyhoFlqPkw==", + "requires": { + "mimic-response": "^2.0.0" + } + }, + "detect-libc": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz", + "integrity": "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==" + }, + "mimic-response": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-2.1.0.tgz", + "integrity": "sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA==" + }, + "node-abi": { + "version": "2.30.1", + "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-2.30.1.tgz", + "integrity": "sha512-/2D0wOQPgaUWzVSVgRMx+trKJRC2UG4SUc4oCJoXx9Uxjtp0Vy3/kt7zcbxHF8+Z/pK3UloLWzBISg72brfy1w==", + "requires": { + "semver": "^5.4.1" + }, + "dependencies": { + "semver": { + "version": "5.7.1", + "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz", + "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==" + } + } + }, + "node-addon-api": { + "version": "3.2.1", + "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.2.1.tgz", + "integrity": "sha512-mmcei9JghVNDYydghQmeDX8KoAm0FAiYyIcUt/N4nhyAipB17pllZQDOJD2fotxABnt4Mdz+dKTO7eftLg4d0A==" + }, + "prebuild-install": { + "version": "5.3.6", + "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-5.3.6.tgz", + "integrity": "sha512-s8Aai8++QQGi4sSbs/M1Qku62PFK49Jm1CbgXklGz4nmHveDq0wzJkg7Na5QbnO1uNH8K7iqx2EQ/mV0MZEmOg==", + "requires": { + "detect-libc": "^1.0.3", + "expand-template": "^2.0.3", + "github-from-package": "0.0.0", + "minimist": "^1.2.3", + "mkdirp-classic": "^0.5.3", + "napi-build-utils": "^1.0.1", + "node-abi": "^2.7.0", + "noop-logger": "^0.1.1", + "npmlog": "^4.0.1", + "pump": "^3.0.0", + "rc": "^1.2.7", + "simple-get": "^3.0.3", + "tar-fs": "^2.0.0", + "tunnel-agent": "^0.6.0", + "which-pm-runs": "^1.0.0" + }, + "dependencies": { + "simple-get": { + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-3.1.1.tgz", + "integrity": "sha512-CQ5LTKGfCpvE1K0n2us+kuMPbk/q0EKl82s4aheV9oXjFEz6W/Y7oQFVJuU6QG77hRT4Ghb5RURteF5vnWjupA==", + "requires": { + "decompress-response": "^4.2.0", + "once": "^1.3.1", + "simple-concat": "^1.0.0" + } + } + } + }, + "semver": { + "version": "7.3.8", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz", + "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==", + "requires": { + "lru-cache": "^6.0.0" + }, + "dependencies": { + "lru-cache": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", + "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", + "requires": { + "yallist": "^4.0.0" + } + } + } + }, + "sharp": { + "version": "0.25.4", + "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.25.4.tgz", + "integrity": "sha512-umSzJJ1oBwIOfwFFt/fJ7JgCva9FvrEU2cbbm7u/3hSDZhXvkME8WE5qpaJqLIe2Har5msF5UG4CzYlEg5o3BQ==", + "requires": { + "color": "^3.1.2", + "detect-libc": "^1.0.3", + "node-addon-api": "^3.0.0", + "npmlog": "^4.1.2", + "prebuild-install": "^5.3.4", + "semver": "^7.3.2", + "simple-get": "^4.0.0", + "tar": "^6.0.2", + "tunnel-agent": "^0.6.0" + } + }, + "yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + } } }, "har-schema": { @@ -21799,6 +22002,37 @@ "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz", "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==" }, + "minipass": { + "version": "3.3.4", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.4.tgz", + "integrity": "sha512-I9WPbWHCGu8W+6k1ZiGpPu0GkoKBeorkfKNuAFBNS1HNFJvke82sxvI5bzcCNpWPorkOO5QQ+zomzzwRxejXiw==", + "requires": { + "yallist": "^4.0.0" + }, + "dependencies": { + "yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + } + } + }, + "minizlib": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz", + "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==", + "requires": { + "minipass": "^3.0.0", + "yallist": "^4.0.0" + }, + "dependencies": { + "yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + } + } + }, "mississippi": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/mississippi/-/mississippi-3.0.0.tgz", @@ -21956,42 +22190,6 @@ "lower-case": "^1.1.1" } }, - "node-abi": { - "version": "3.22.0", - "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.22.0.tgz", - "integrity": "sha512-u4uAs/4Zzmp/jjsD9cyFYDXeISfUWaAVWshPmDZOFOv4Xl4SbzTXm53I04C2uRueYJ+0t5PEtLH/owbn2Npf/w==", - "requires": { - "semver": "^7.3.5" - }, - "dependencies": { - "lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "requires": { - "yallist": "^4.0.0" - } - }, - "semver": { - "version": "7.3.7", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz", - "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==", - "requires": { - "lru-cache": "^6.0.0" - } - }, - "yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" - } - } - }, - "node-addon-api": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-5.0.0.tgz", - "integrity": "sha512-CvkDw2OEnme7ybCykJpVcKH+uAOLV2qLqiyla128dN9TkEWfrYmxG6C2boDe5KcNQqZF3orkqzGgOMvZ/JNekA==" - }, "node-libs-browser": { "version": "2.2.1", "resolved": "https://registry.npmjs.org/node-libs-browser/-/node-libs-browser-2.2.1.tgz", @@ -22044,6 +22242,11 @@ "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.4.tgz", "integrity": "sha512-gbMzqQtTtDz/00jQzZ21PQzdI9PyLYqUSvD0p3naOhX4odFji0ZxYdnVwPTxmSwkmxhcFImpozceidSG+AgoPQ==" }, + "noop-logger": { + "version": "0.1.1", + "resolved": "https://registry.npmjs.org/noop-logger/-/noop-logger-0.1.1.tgz", + "integrity": "sha512-6kM8CLXvuW5crTxsAtva2YLrRrDaiTIkIePWs9moLHqbFWT94WpNFjwS/5dfLfECg5i/lkmw3aoqVidxt23TEQ==" + }, "normalize-package-data": { "version": "2.5.0", "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz", @@ -23310,26 +23513,6 @@ "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz", "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==" }, - "prebuild-install": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.0.tgz", - "integrity": "sha512-CNcMgI1xBypOyGqjp3wOc8AAo1nMhZS3Cwd3iHIxOdAUbb+YxdNuM4Z5iIrZ8RLvOsf3F3bl7b7xGq6DjQoNYA==", - "requires": { - "detect-libc": "^2.0.0", - "expand-template": "^2.0.3", - "github-from-package": "0.0.0", - "minimist": "^1.2.3", - "mkdirp-classic": "^0.5.3", - "napi-build-utils": "^1.0.1", - "node-abi": "^3.3.0", - "npmlog": "^4.0.1", - "pump": "^3.0.0", - "rc": "^1.2.7", - "simple-get": "^4.0.0", - "tar-fs": "^2.0.0", - "tunnel-agent": "^0.6.0" - } - }, "prepend-http": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/prepend-http/-/prepend-http-2.0.0.tgz", @@ -24262,61 +24445,6 @@ "safe-buffer": "^5.0.1" } }, - "sharp": { - "version": "0.30.6", - "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.30.6.tgz", - "integrity": "sha512-lSdVxFxcndzcXggDrak6ozdGJgmIgES9YVZWtAFrwi+a/H5vModaf51TghBtMPw+71sLxUsTy2j+aB7qLIODQg==", - "requires": { - "color": "^4.2.3", - "detect-libc": "^2.0.1", - "node-addon-api": "^5.0.0", - "prebuild-install": "^7.1.0", - "semver": "^7.3.7", - "simple-get": "^4.0.1", - "tar-fs": "^2.1.1", - "tunnel-agent": "^0.6.0" - }, - "dependencies": { - "color": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/color/-/color-4.2.3.tgz", - "integrity": "sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==", - "requires": { - "color-convert": "^2.0.1", - "color-string": "^1.9.0" - } - }, - "color-convert": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", - "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", - "requires": { - "color-name": "~1.1.4" - } - }, - "lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "requires": { - "yallist": "^4.0.0" - } - }, - "semver": { - "version": "7.3.7", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz", - "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==", - "requires": { - "lru-cache": "^6.0.0" - } - }, - "yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" - } - } - }, "shebang-command": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz", @@ -25190,6 +25318,36 @@ "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.0.0-beta.5.tgz", "integrity": "sha512-P4o84kC8CD66ZuCs6noh3QLU2ZuaBvMl0yCmp9rr0GXZyIfLd1sB2ZvJZjitQgfds8GDKRLmiiAcssr2bEHQ0A==" }, + "tar": { + "version": "6.1.11", + "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.11.tgz", + "integrity": "sha512-an/KZQzQUkZCkuoAA64hM92X0Urb6VpRhAFllDzz44U2mcD5scmT3zBc4VgVpkugF580+DQn8eAFSyoQt0tznA==", + "requires": { + "chownr": "^2.0.0", + "fs-minipass": "^2.0.0", + "minipass": "^3.0.0", + "minizlib": "^2.1.1", + "mkdirp": "^1.0.3", + "yallist": "^4.0.0" + }, + "dependencies": { + "chownr": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz", + "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==" + }, + "mkdirp": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz", + "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==" + }, + "yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + } + } + }, "tar-fs": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz", @@ -26357,6 +26515,11 @@ "is-symbol": "^1.0.3" } }, + "which-pm-runs": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/which-pm-runs/-/which-pm-runs-1.1.0.tgz", + "integrity": "sha512-n1brCuqClxfFfq/Rb0ICg9giSZqCS+pLtccdag6C2HyufBrh3fBOiy9nb6ggRMvWOVH5GrdJskj5iGTZNxd7SA==" + }, "wide-align": { "version": "1.1.5", "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.5.tgz", diff --git a/package.json b/package.json index 613683853..817debdf1 100644 --- a/package.json +++ b/package.json @@ -33,7 +33,6 @@ "trim-newlines": "^3.0.1", "glob-parent": "^5.1.2", "moment": "^2.29.4", - "sharp": "^0.30.5", "terser": "^4.8.1" } } diff --git a/src/main.js b/src/main.js index af1ac3cf8..b978ac68f 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'self'; img-src https://*; child-src 'none';" + content: "default-src 'unsafe-inline'; img-src *; child-src 'none'; script-src-elem *" }) head.meta.push({ name: 'og:type', From e5c255c3737897730ac82c4dd6f6bcaab83bc661 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 13:03:24 -0400 Subject: [PATCH 03/18] CSP headers, more rules --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index b978ac68f..0c134e50c 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline'; img-src *; child-src 'none'; script-src-elem *" + content: "default-src 'unsafe-inline'; img-src self data:; child-src 'none'; script-src-elem *; style-src-elem 'unsafe-inline'; prefetch-src *" }) head.meta.push({ name: 'og:type', From 62598de748aca0f7b66674dbeb37711069ba934b Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 13:09:08 -0400 Subject: [PATCH 04/18] CSP headers, more rules --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index 0c134e50c..f44c3b6f3 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline'; img-src self data:; child-src 'none'; script-src-elem *; style-src-elem 'unsafe-inline'; prefetch-src *" + content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src *" }) head.meta.push({ name: 'og:type', From 6a571463fbfe6bb2e157102ddbf20b5c143816ee Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 13:17:48 -0400 Subject: [PATCH 05/18] yet more rules --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index f44c3b6f3..3ed2f4a34 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src *" + content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src 'self'" }) head.meta.push({ name: 'og:type', From a173fa1edcc8d3da19b67592eee0cfb92a637f73 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 13:31:25 -0400 Subject: [PATCH 06/18] yet more rules --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index 3ed2f4a34..4a5869fbd 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src 'self'" + content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https:// 'self'; font-src 'self'" }) head.meta.push({ name: 'og:type', From d8e7483df4ddcf3f62c4003eb53d9552e9c0d766 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 13:40:13 -0400 Subject: [PATCH 07/18] yet more rules --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index 4a5869fbd..3df07092a 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https:// 'self'; font-src 'self'" + content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https://api.data.gov 'self'; font-src 'self'" }) head.meta.push({ name: 'og:type', From 1087b9f544b84d14794dacdde1286e9d1b9a3bef Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 13:55:14 -0400 Subject: [PATCH 08/18] hopefully last set of permissive rules --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index 3df07092a..4d5918775 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https://api.data.gov 'self'; font-src 'self'" + content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: *.cloud.gov; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https://api.data.gov 'self'; font-src 'self'" }) head.meta.push({ name: 'og:type', From 29a1a1b115515348f6ac1acf26a30eb9c31f3937 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Tue, 25 Oct 2022 14:02:39 -0400 Subject: [PATCH 09/18] more images --- src/main.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.js b/src/main.js index 4d5918775..a01be7de9 100644 --- a/src/main.js +++ b/src/main.js @@ -153,7 +153,7 @@ export default function (Vue, { router, head, isClient, appOptions }) { //Twitter and OpenGraph head.meta.push({ 'http-equiv':'Content-Security-Policy', - content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: *.cloud.gov; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https://api.data.gov 'self'; font-src 'self'" + content: "default-src 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: *.cloud.gov *.googleapis.com; child-src 'none'; script-src-elem * 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; prefetch-src 'self'; connect-src https://api.data.gov 'self'; font-src 'self'" }) head.meta.push({ name: 'og:type', From 2fc30d28ae17cf03816c804ddd98dac0fac95835 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Fri, 28 Oct 2022 09:23:24 -0400 Subject: [PATCH 10/18] glossary links updated --- src/data/glossary.json | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/src/data/glossary.json b/src/data/glossary.json index 921e64fed..71a9083a7 100644 --- a/src/data/glossary.json +++ b/src/data/glossary.json @@ -27,20 +27,20 @@ }, "avg-loan-payment": { "title": "Monthly Student Loan Payment for Loans Taken Out at This School", - "default": "

The median monthly loan payment for student borrowers who completed, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 3.73% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans).

", - "glossary": "

The median monthly loan payment for student borrowers who completed, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 3.73% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator to estimate monthly payments for alternative payment plans. Please see the entry for median total debt after graduation for information on what types of loans are included in this monthly payment. For schools with multiple locations, this information is based on all of their locations.

Relevant variables:
GRAD_DEBT_MDN10YR_SUPP, 2018 and 2019 pooled fiscal year cohort

", + "default": "

The median monthly loan payment for student borrowers who completed, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 3.73% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans).

", + "glossary": "

The median monthly loan payment for student borrowers who completed, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 3.73% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator to estimate monthly payments for alternative payment plans. Please see the entry for median total debt after graduation for information on what types of loans are included in this monthly payment. For schools with multiple locations, this information is based on all of their locations.

Relevant variables:
GRAD_DEBT_MDN10YR_SUPP, 2018 and 2019 pooled fiscal year cohort

", "branch": true }, "parent-plus-avg-loan-payment": { "title": "Monthly Parent PLUS Loan Payment for Loans Taken Out at This School", - "default": "

The median monthly loan payment for parents who borrowed on behalf of a student who completed, based only on Parent PLUS loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans).

", - "glossary": "

The median monthly loan payment for Parent PLUS loan borrowers is based on the typical total PLUS loan debt after graduation, based only on PLUS loan debt originated at the school awarding the credential, and assumes standard repayment terms of a 10 year amortization using the current interest rate for subsidized federal loans, 6.28%. This 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculator to estimate monthly payments for alternative payment plans. For schools with multiple locations, this information is based on all of their locations.

Relevant variables:
PLUS_DEBT_INST_COMP_MDPAY10_SUPP, 2018-19 and 2019-20 pooled award year cohort

", + "default": "

The median monthly loan payment for parents who borrowed on behalf of a student who completed, based only on Parent PLUS loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans).

", + "glossary": "

The median monthly loan payment for Parent PLUS loan borrowers is based on the typical total PLUS loan debt after graduation, based only on PLUS loan debt originated at the school awarding the credential, and assumes standard repayment terms of a 10 year amortization using the current interest rate for subsidized federal loans, 6.28%. This 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculator to estimate monthly payments for alternative payment plans. For schools with multiple locations, this information is based on all of their locations.

Relevant variables:
PLUS_DEBT_INST_COMP_MDPAY10_SUPP, 2018-19 and 2019-20 pooled award year cohort

", "branch": true }, "parent-plus-avg-loan-payment-all-schools": { "title": "Monthly Parent PLUS Loan Payment for All Federal Loans", - "default": "

The median monthly loan payment for parents who borrowed on behalf of a student who completed, based on Parent PLUS loan debt originated at any school attended prior to award of this credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans).

", - "glossary": "

The median monthly loan payment for Parent PLUS loan borrowers is based on the typical total PLUS loan debt after graduation, based on PLUS loan debt originated at any school attended prior to award of this credential, and assumes standard repayment terms of a 10 year amortization using the current interest rate for subsidized federal loans, 6.28%. This 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculator to estimate monthly payments for alternative payment plans. For schools with multiple locations, this information is based on all of their locations.

Relevant Variables:
PLUS_DEBT_ALL_COMP_MDPAY10_SUPP, 2018-19 and 2019-20 pooled award year cohort

", + "default": "

The median monthly loan payment for parents who borrowed on behalf of a student who completed, based on Parent PLUS loan debt originated at any school attended prior to award of this credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans).

", + "glossary": "

The median monthly loan payment for Parent PLUS loan borrowers is based on the typical total PLUS loan debt after graduation, based on PLUS loan debt originated at any school attended prior to award of this credential, and assumes standard repayment terms of a 10 year amortization using the current interest rate for subsidized federal loans, 6.28%. This 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculator to estimate monthly payments for alternative payment plans. For schools with multiple locations, this information is based on all of their locations.

Relevant Variables:
PLUS_DEBT_ALL_COMP_MDPAY10_SUPP, 2018-19 and 2019-20 pooled award year cohort

", "branch": true }, "avg-debt": { @@ -89,7 +89,7 @@ "race-eth": { "title": "Race/Ethnicity", "default": "The proportion of students in specific race/ethnicity categories.", - "glossary": "

The proportion of students in specific race/ethnicity categories (including foreign students) following the categories described in this link.

Relevant variables:
UGDS_WHITE, fall 2020 cohort
UGDS_BLACK, fall 2020 cohort
UGDS_HISP, fall 2020 cohort
UGDS_ASIAN, fall 2020 cohort
UGDS_AIAN, fall 2020 cohort
UGDS_NHPI, fall 2020 cohort
UGDS_2MOR, fall 2020 cohort
UGDS_NRA, fall 2020 cohort
UGDS_UNKN, fall 2020 cohort

", + "glossary": "

The proportion of students in specific race/ethnicity categories (including foreign students) following the categories described in this link.

Relevant variables:
UGDS_WHITE, fall 2020 cohort
UGDS_BLACK, fall 2020 cohort
UGDS_HISP, fall 2020 cohort
UGDS_ASIAN, fall 2020 cohort
UGDS_AIAN, fall 2020 cohort
UGDS_NHPI, fall 2020 cohort
UGDS_2MOR, fall 2020 cohort
UGDS_NRA, fall 2020 cohort
UGDS_UNKN, fall 2020 cohort

", "branch": false }, "socio-eco": { @@ -154,16 +154,16 @@ }, "fos-monthly-debt-payment": { "title": "Field of Study Monthly Loan Payment for Loans Taken Out at This School", - "default": "

The median monthly loan payment for student borrowers who graduated in the indicated field of study, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 3.73% interest rate. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", - "graduate": "

The median monthly loan payment of borrowers who graduated in the indicated field of study, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", - "glossary": "

The median monthly loan payment is calculated from the cumulative median debt of individuals who completed an award in the indicated field of study, based only on federal loan debt originated at the school awarding the credential. It assumes standard repayment terms of a 10 year amortization using the current interest rate for undergraduate federal loans (3.73%) for undergraduate programs and the current interest rate for graduate PLUS loans (6.28%) or graduate-level programs. A 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculatorto estimate monthly payments for alternative payment plans. Please see the entry for median debt by field of study for information on the median debt calculation.

For schools with multiple locations, this information is based on all of their locations.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

Relevant variables:
DEBT_ALL_STGP_EVAL_MDN10YRPAY, 2017-18 and 2018-19 pooled award year cohort

", + "default": "

The median monthly loan payment for student borrowers who graduated in the indicated field of study, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 3.73% interest rate. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", + "graduate": "

The median monthly loan payment of borrowers who graduated in the indicated field of study, based only on federal loan debt originated at the school awarding the credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", + "glossary": "

The median monthly loan payment is calculated from the cumulative median debt of individuals who completed an award in the indicated field of study, based only on federal loan debt originated at the school awarding the credential. It assumes standard repayment terms of a 10 year amortization using the current interest rate for undergraduate federal loans (3.73%) for undergraduate programs and the current interest rate for graduate PLUS loans (6.28%) or graduate-level programs. A 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculatorto estimate monthly payments for alternative payment plans. Please see the entry for median debt by field of study for information on the median debt calculation.

For schools with multiple locations, this information is based on all of their locations.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

Relevant variables:
DEBT_ALL_STGP_EVAL_MDN10YRPAY, 2017-18 and 2018-19 pooled award year cohort

", "branch": true }, "fos-monthly-debt-payment-all-schools": { "title": "Field of Study Monthly Loan Payment for All Federal Loans", - "default": "

The median monthly loan payment for student borrowers who graduated in the indicated field of study, based on federal loan debt originated at any school attended prior to award of this credential, if it were repaid over 10 years at a 3.73% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", - "graduate": "

The median monthly loan payment of borrowers who graduated in the indicated field of study, based on federal loan debt originated at any school attended prior to award of this credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", - "glossary": "

The median monthly loan payment is calculated from the cumulative median debt of individuals who completed an award in the indicated field of study, based on federal loan debt originated at any school attended prior to award of this credential. It assumes standard repayment terms of a 10 year amortization using the current interest rate for undergraduate federal loans (3.73%) for undergraduate programs and the current interest rate for graduate PLUS loans (6.28%) or graduate-level programs. A 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculator (to estimate monthly payments for alternative payment plans). Please see the entry for median debt by field of study for information on the median debt calculation.

For schools with multiple locations, this information is based on all of their locations.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

Relevant variables:
DEBT_ALL_STGP_ANY_MDN10YRPAY, 2017-18 and 2018-19 pooled award year cohort

", + "default": "

The median monthly loan payment for student borrowers who graduated in the indicated field of study, based on federal loan debt originated at any school attended prior to award of this credential, if it were repaid over 10 years at a 3.73% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", + "graduate": "

The median monthly loan payment of borrowers who graduated in the indicated field of study, based on federal loan debt originated at any school attended prior to award of this credential, if it were repaid over 10 years at a 6.28% interest rate. This 10-year fixed payment plan is just one of several plans available to federal borrowers. Please see the repayment calculator (to estimate monthly payments for alternative payment plans). Only certain loans are included in the calculation.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

", + "glossary": "

The median monthly loan payment is calculated from the cumulative median debt of individuals who completed an award in the indicated field of study, based on federal loan debt originated at any school attended prior to award of this credential. It assumes standard repayment terms of a 10 year amortization using the current interest rate for undergraduate federal loans (3.73%) for undergraduate programs and the current interest rate for graduate PLUS loans (6.28%) or graduate-level programs. A 10-year fixed payment plan is just one of several plans available to federal borrowers, please see the repayment calculator (to estimate monthly payments for alternative payment plans). Please see the entry for median debt by field of study for information on the median debt calculation.

For schools with multiple locations, this information is based on all of their locations.

These data are based on school-reported information about students’ program of completion. The U.S. Department of Education cannot fully confirm the completeness of these reported data for this school.

Relevant variables:
DEBT_ALL_STGP_ANY_MDN10YRPAY, 2017-18 and 2018-19 pooled award year cohort

", "branch": true }, "fos-median-earnings": { From fc437221b26fab12ba3c4bfa8a5642a4fffa6b08 Mon Sep 17 00:00:00 2001 From: Alexander Smith Date: Wed, 2 Nov 2022 10:19:33 -0400 Subject: [PATCH 11/18] some aria labels --- src/components/Tooltip.vue | 1 + 1 file changed, 1 insertion(+) diff --git a/src/components/Tooltip.vue b/src/components/Tooltip.vue index 0161d947e..8675a7479 100644 --- a/src/components/Tooltip.vue +++ b/src/components/Tooltip.vue @@ -5,6 +5,7 @@ icon small class="align-start ml-n2" + aria-label="More information for " + title > fas fa-info-circle Date: Wed, 2 Nov 2022 10:34:40 -0400 Subject: [PATCH 12/18] fixed aria label --- src/components/NameAutocomplete.vue | 1 + src/components/Tooltip.vue | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/components/NameAutocomplete.vue b/src/components/NameAutocomplete.vue index 0589c07bb..c66eee097 100644 --- a/src/components/NameAutocomplete.vue +++ b/src/components/NameAutocomplete.vue @@ -84,6 +84,7 @@ export default { } query["school.search"] = newVal ? newVal : "" + query[fields.OPEID + '__not'] = 'null'; query = this.prepareParams(query) let request = apiGet("/schools", query) diff --git a/src/components/Tooltip.vue b/src/components/Tooltip.vue index 8675a7479..4d3f08e7c 100644 --- a/src/components/Tooltip.vue +++ b/src/components/Tooltip.vue @@ -5,7 +5,7 @@ icon small class="align-start ml-n2" - aria-label="More information for " + title + aria-label=title > fas fa-info-circle Date: Wed, 2 Nov 2022 11:24:06 -0400 Subject: [PATCH 13/18] added correct bindings --- src/components/Tooltip.vue | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/components/Tooltip.vue b/src/components/Tooltip.vue index 4d3f08e7c..ee3516c38 100644 --- a/src/components/Tooltip.vue +++ b/src/components/Tooltip.vue @@ -1,16 +1,18 @@ -