lobsters/lobsters

Remove inline scripts from lobste.rs

Open

#697 opened on Jun 26, 2019

View on GitHubContributor guide
 (3 comments) (0 reactions) (0 assignees)Ruby (961 forks)user submission
featurereqgood first issue

Repository metrics

Stars
 (4,680 stars)
PR merge metrics
 (Avg merge 7d 4h) (20 merged PRs in 30d)

Description

Related to: https://github.com/lobsters/lobsters/issues/486#issuecomment-437617883

Removing inline scripts from the code will allow us to enable a stricter content security policy.

Contributor guide

Research direction
Search the views and partials for inline script tags (e.g., <script>...</script>), extract them into separate JavaScript files, and load them via the asset pipeline or external sources. Update the Content Security Policy accordingly.
Tech stack
rubyjavascript
Domain
backendfrontend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitRubyJavaScript
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70