Security: optionally drop CSP 'unsafe-inline' via a nonce (post-sanitize hardening)

[williamzujkowski]

From the broad QA/security sweep (consensus, adversarially verified). These are structural to static GitHub Pages hosting (no server to send real HTTP response headers) + the meta-only CSP, so they need a decision rather than a one-line fix. (The inert X-Content-Type-Options/Permissions-Policy metas and the Referrer-Policy→<meta name="referrer"> fix are handled in the QA-sweep PR; these remain.)

1. 'unsafe-inline' script-src + no HTML sanitization (HIGH)

script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' (BaseLayout) + the markdown rehype pipeline has no rehype-sanitize — raw HTML in posts renders verbatim. Real protection is currently 100% process (only the author writes posts). Options: add a rehype-sanitize allowlist pass (must not strip .flow/.arch/.zine-doodle markup), and/or drop 'unsafe-inline' by giving the one legit inline script (theme-flash snippet) a nonce/hash. Note the feed (feed.xml.ts) already sanitizes post HTML — the page render path doesn't, an inconsistent trust boundary.

2. Broken gist embeds — 7 posts (HIGH, user-facing)

7 posts contain live <script src="https://gist.github.com/…js"> embeds that the CSP blocks (gist.github.com isn't in script-src), so they don't render for readers. Decide: allowlist the github gist domains in CSP (relaxes policy, adds external script/style), or inline the code from the gists/ source-of-truth dir, or remove the dead <script> tags. Inlining is the most secure + fastest-loading.

3. No clickjacking protection (HIGH, structural)

CSP omits frame-ancestors, and frame-ancestors is ignored when CSP is delivered via <meta> (CSP L3 spec); X-Frame-Options has no meta form. So the site is iframe-embeddable anywhere. Only fixable by fronting GH Pages with an edge (Cloudflare/Netlify _headers) that can send real headers — a hosting decision.

Recommendation: #2 (inline gists) is a clear win; #1 (sanitize) is worth doing for defense-in-depth; #3 is accept-or-migrate-hosting.

[williamzujkowski]

Gist part done (PR #428): the 43 CSP-blocked <script> embeds across 7 posts are now clean 🔖 [description ↗] links (labels from gist-mapping.json). Fixes the user-facing broken-embed bug and removes 43 raw <script> tags. Remaining #424 items — unsafe-inline/HTML-sanitization and clickjacking (GH Pages structural) — still open.

[williamzujkowski]

Clickjacking (frame-ancestors / X-Frame-Options): won't-fix. Confirmed with the maintainer we're staying on GitHub Pages, which has no way to send real HTTP response headers, and frame-ancestors is ignored when CSP is delivered via <meta>. Accepting the residual iframe-embeddability risk (low for a static personal blog with no auth/session). Remaining work here: the HTML-sanitization attempt (in progress on feat/rehype-sanitize).

[williamzujkowski]

HTML sanitization: DONE (PR #430). rehype-raw + rehype-sanitize now run last in the pipeline with a schema that keeps all site markup (.flow/.arch/.zine-doodle/mermaid/sidenotes) and strips <script>/on*/javascript:. Independently verified: content byte-stable + attacks stripped. Follow-up: now that content is sanitized, 'unsafe-inline' could be dropped by nonce-ing the one inline theme-flash script — small separate change. With clickjacking marked won't-fix and gists fixed (#428), the actionable parts of #424 are complete.

[williamzujkowski]

Grooming: narrowed. Most of the original scope shipped this session — HTML sanitization (#430, rehype-sanitize), the 43 broken gist embeds (#428), the inert security-header metas removed + Referrer-Policy fixed (#427), and clickjacking marked won't-fix (static GitHub Pages). The only remaining item is optional: now that post content is sanitized, 'unsafe-inline' in the CSP could be dropped by giving the one legitimate inline theme-flash script a nonce/hash. Low priority, defense-in-depth. Retitled to reflect that.

[williamzujkowski]

Heads-up for the CSP-tightening work: PR #439 (mobile TOC collapse, #438) adds one inline <script> in TableOfContents.astro, relying on the current script-src 'unsafe-inline'. It's consistent with the ~7 pages that already ship inline scripts, but when this issue removes 'unsafe-inline', that TOC script (and the existing inline scripts) will need a per-script hash/nonce or extraction to a same-origin .js file. Listing it here so it's not missed.

[williamzujkowski]

Important constraint for scoping this: the issue title says nonce, but this site is static GitHub Pages — there's no server to generate an unpredictable per-response nonce, and the CSP is delivered via a <meta> tag (per the existing BaseLayout.astro comment, only CSP-meta + referrer-meta are effective here). A static, build-time-fixed nonce is worthless (predictable = bypassable), so the nonce approach doesn't actually apply.

The static-compatible path is a hash-based CSP: script-src 'self' 'sha256-…' … listing the sha256 of every inline script (and style-src hashes for inline styles, if we drop 'unsafe-inline' there too). Astro can emit these, but it means:

• Every inline script must be enumerated/hashed at build (the TOC PE script from fix(toc): collapse the on-this-page TOC on mobile (#438) #439, plus the ~7 existing inline-script pages). A missed one breaks silently in-browser, and CI may not catch it (CSP enforcement is client-side).
• style-src is harder — inline styles and style="…" attributes are common; 'unsafe-hashes' or refactoring may be needed.

Recommendation: treat this as script-src hardening first (drop script 'unsafe-inline', add per-script hashes, keep style-src as-is), with a way to verify no CSP violations across representative pages before shipping. Alternatively, extract the few inline scripts to same-origin .js files so script-src 'self' alone suffices (no hashes to maintain) — likely the cleaner long-term shape. Flagging so the approach is chosen deliberately.