Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Fetch avatar icons without a Referer
The icons came from Gravatar or Libravatar with the page's url as the
Referer, so the service learned which repositories and commits each
visitor looked at.
| -rw-r--r-- | custom/extensions/email-gravatar.lua | 6 | |
| -rw-r--r-- | custom/extensions/email-libravatar.lua | 6 | |
| -rw-r--r-- | tests/extensions/test-email-avatar.lua | 1 |
3 files changed, 11 insertions, 2 deletions
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua index 23fb508..622196f 100644 --- a/custom/extensions/email-gravatar.lua +++ b/custom/extensions/email-gravatar.lua @@ -6,6 +6,10 @@ -- -- email-filter=lua:/path/to/email-gravatar.lua -- +-- The visitor's browser fetches each icon from Gravatar, which learns the hash +-- of the address and the visitor's IP address, but not the page, since the +-- icon is fetched without a Referer. +-- -- Runs on Lua 5.1 through 5.5 and LuaJIT, where 5.5 needs luaossl 20260910 or -- later, or a build patched for 5.5 such as Alpine's, since earlier releases -- fail to load there. @@ -133,7 +137,7 @@ function filter_close() "' srcset='" .. avatar_url(avatar_size * 2) .. " 2x" .. "' alt='' width='" .. avatar_size .. "' height='" .. avatar_size .. - "' loading='lazy' decoding='async'> " .. text) + "' loading='lazy' decoding='async' referrerpolicy='no-referrer'> " .. text) end return 0 end diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua index edf4733..835b48f 100644 --- a/custom/extensions/email-libravatar.lua +++ b/custom/extensions/email-libravatar.lua @@ -5,6 +5,10 @@ -- -- email-filter=lua:/path/to/email-libravatar.lua -- +-- The visitor's browser fetches each icon from Libravatar, which learns the +-- hash of the address and the visitor's IP address, but not the page, since +-- the icon is fetched without a Referer. +-- -- Runs on Lua 5.1 through 5.5 and LuaJIT, where 5.5 needs luaossl 20260910 or -- later, or a build patched for 5.5 such as Alpine's, since earlier releases -- fail to load there. @@ -132,7 +136,7 @@ function filter_close() "' srcset='" .. avatar_url(avatar_size * 2) .. " 2x" .. "' alt='' width='" .. avatar_size .. "' height='" .. avatar_size .. - "' loading='lazy' decoding='async'> " .. text) + "' loading='lazy' decoding='async' referrerpolicy='no-referrer'> " .. text) end return 0 end diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.lua index aa021e2..65c4ce9 100644 --- a/tests/extensions/test-email-avatar.lua +++ b/tests/extensions/test-email-avatar.lua @@ -56,6 +56,7 @@ h.contains("the icon is marked decorative", out, "alt='' width=") h.contains("width matches the size", out, "width='13'") h.contains("height matches the size", out, "height='13'") h.contains("the fetch is deferred", out, "loading='lazy' decoding='async'") +h.contains("the fetch carries no Referer", out, "referrerpolicy='no-referrer'") h.contains("the name follows the icon", out, "> A U Thor") h.equals("close answers zero", ret, 0) h.check("the hash is hex", hash_of(out) ~= nil) |