From d55bfcdc3f3b49736837a6b568bda576bdb8c68c Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 6 Nov 2026 23:00:24 -1000 Subject: Fetch avatar icons without a Referer The icons came from Gravatar or Libravatar with the page's url as the Referer, so the service learned which repositories and commits each visitor looked at. --- custom/extensions/email-gravatar.lua | 6 +++++- custom/extensions/email-libravatar.lua | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) (limited to 'custom') diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua index 23fb508..622196f 100644 --- a/custom/extensions/email-gravatar.lua +++ b/custom/extensions/email-gravatar.lua @@ -6,6 +6,10 @@ -- -- email-filter=lua:/path/to/email-gravatar.lua -- +-- The visitor's browser fetches each icon from Gravatar, which learns the hash +-- of the address and the visitor's IP address, but not the page, since the +-- icon is fetched without a Referer. +-- -- Runs on Lua 5.1 through 5.5 and LuaJIT, where 5.5 needs luaossl 20260910 or -- later, or a build patched for 5.5 such as Alpine's, since earlier releases -- fail to load there. @@ -133,7 +137,7 @@ function filter_close() "' srcset='" .. avatar_url(avatar_size * 2) .. " 2x" .. "' alt='' width='" .. avatar_size .. "' height='" .. avatar_size .. - "' loading='lazy' decoding='async'> " .. text) + "' loading='lazy' decoding='async' referrerpolicy='no-referrer'> " .. text) end return 0 end diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua index edf4733..835b48f 100644 --- a/custom/extensions/email-libravatar.lua +++ b/custom/extensions/email-libravatar.lua @@ -5,6 +5,10 @@ -- -- email-filter=lua:/path/to/email-libravatar.lua -- +-- The visitor's browser fetches each icon from Libravatar, which learns the +-- hash of the address and the visitor's IP address, but not the page, since +-- the icon is fetched without a Referer. +-- -- Runs on Lua 5.1 through 5.5 and LuaJIT, where 5.5 needs luaossl 20260910 or -- later, or a build patched for 5.5 such as Alpine's, since earlier releases -- fail to load there. @@ -132,7 +136,7 @@ function filter_close() "' srcset='" .. avatar_url(avatar_size * 2) .. " 2x" .. "' alt='' width='" .. avatar_size .. "' height='" .. avatar_size .. - "' loading='lazy' decoding='async'> " .. text) + "' loading='lazy' decoding='async' referrerpolicy='no-referrer'> " .. text) end return 0 end -- cgit 2.12.1