From d55bfcdc3f3b49736837a6b568bda576bdb8c68c Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 6 Nov 2026 23:00:24 -1000 Subject: Fetch avatar icons without a Referer The icons came from Gravatar or Libravatar with the page's url as the Referer, so the service learned which repositories and commits each visitor looked at. --- tests/extensions/test-email-avatar.lua | 1 + 1 file changed, 1 insertion(+) (limited to 'tests/extensions/test-email-avatar.lua') diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.lua index aa021e2..65c4ce9 100644 --- a/tests/extensions/test-email-avatar.lua +++ b/tests/extensions/test-email-avatar.lua @@ -56,6 +56,7 @@ h.contains("the icon is marked decorative", out, "alt='' width=") h.contains("width matches the size", out, "width='13'") h.contains("height matches the size", out, "height='13'") h.contains("the fetch is deferred", out, "loading='lazy' decoding='async'") +h.contains("the fetch carries no Referer", out, "referrerpolicy='no-referrer'") h.contains("the name follows the icon", out, "> A U Thor") h.equals("close answers zero", ret, 0) h.check("the hash is hex", hash_of(out) ~= nil) -- cgit 2.12.1