From 4f334fdd8a232c81a8725be5b79e6f8c4ba333d2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 25 Feb 2026 20:02:11 +0000
Subject: [PATCH 1/2] Initial plan


From d67f9b47f618cd4a84fb3c194e5e6ccc6bc4b9ea Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 25 Feb 2026 20:08:26 +0000
Subject: [PATCH 2/2] Security hardening: CSP, referrer policy, inline script
 extraction, Bunny Fonts, iframe sandbox

Co-authored-by: benfoxall <51385+benfoxall@users.noreply.github.com>
---
 _layouts/default.html | 13 +++++++------
 _layouts/hack.html    | 14 +-------------
 assets/local-time.js  | 13 +++++++++++++
 assets/nav-current.js |  3 +++
 pages/index.html      | 14 +-------------
 pages/podcast.md      |  2 +-
 6 files changed, 26 insertions(+), 33 deletions(-)
 create mode 100644 assets/local-time.js
 create mode 100644 assets/nav-current.js
diff --git a/_layouts/default.html b/_layouts/default.html
index d1e9fb2..60f7f7c 100644
--- a/_layouts/default.html
+++ b/_layouts/default.html
@@ -4,8 +4,10 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+  <meta name="referrer" content="strict-origin-when-cross-origin">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' https://fonts.bunny.net; font-src https://fonts.bunny.net; img-src 'self' data:; frame-src https://open.spotify.com; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'">
 
-  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600&family=Space+Mono:wght@400&display=swap"
+  <link href="https://fonts.bunny.net/css2?family=Inter:wght@400;600&family=Space+Mono:wght@400&display=swap"
     rel="stylesheet">
   <link rel="stylesheet" href="/assets/style.css">
 
@@ -63,9 +65,8 @@
     {% endunless %}
   </nav>
 
-  <script>
-    for (const a of document.querySelectorAll('.🗺 a')) if (location.href === a.href) a.classList.add('current')
-  </script>
+  <script src="/assets/nav-current.js" defer></script>
+  <script src="/assets/local-time.js" defer></script>
 
 
   {% if page.show_header %}
@@ -90,10 +91,10 @@ <h1 class="⭐️">
     <footer>
       <ul class="🔗">
         <li>
-          Header image – <a href="https://back7.co/home/raspberry-pi-recovery-kit">The Raspberry Pi Recovery Kit</a>
+          Header image – <a href="https://back7.co/home/raspberry-pi-recovery-kit" rel="noopener noreferrer">The Raspberry Pi Recovery Kit</a>
         </li>
         <li>
-          Site hosted with <a href="https://github.com">Github</a>. {% if site.github %}View the <a href="{{ site.github.repository_url }}">source repository</a>.{% endif %}
+          Site hosted with <a href="https://github.com" rel="noopener noreferrer">Github</a>. {% if site.github %}View the <a href="{{ site.github.repository_url }}" rel="noopener noreferrer">source repository</a>.{% endif %}
         </li>
       </ul>
     </footer>
diff --git a/_layouts/hack.html b/_layouts/hack.html
index ccc30e1..aa6dab9 100644
--- a/_layouts/hack.html
+++ b/_layouts/hack.html
@@ -11,19 +11,7 @@ <h1>
 {% if pagesize < 2 %}
   {%- capture content -%}
   {% assign start_time = page.date | slice:0,10 | append:"T08:30Z" %}
-  This hack is happening on <time style="font-weight: bold;" datetime="{{start_time}}">{{ start_time| date_to_long_string }}<span>
-    <script>
-      document.currentScript.replaceWith(
-        document.createTextNode(
-          new Intl.DateTimeFormat('default', {
-            hour: 'numeric',
-            minute: 'numeric',
-            timeZoneName: 'long'
-          })
-            .format(new Date("{{start_time}}"))
-        )
-      )
-    </script>
+  This hack is happening on <time style="font-weight: bold;" datetime="{{start_time}}">{{ start_time| date_to_long_string }}<span class="local-time">
     <noscript>
       {{ start_time | date: "%k:%M%P %Z" }}
     </noscript>
diff --git a/assets/local-time.js b/assets/local-time.js
new file mode 100644
index 0000000..5f69dc3
--- /dev/null
+++ b/assets/local-time.js
@@ -0,0 +1,13 @@
+document.querySelectorAll('time[datetime] .local-time').forEach(function (span) {
+  var timeEl = span.closest('time[datetime]');
+  if (!timeEl) return;
+  var dt = timeEl.getAttribute('datetime');
+  if (!dt) return;
+  try {
+    span.textContent = new Intl.DateTimeFormat('default', {
+      hour: 'numeric',
+      minute: 'numeric',
+      timeZoneName: 'long'
+    }).format(new Date(dt));
+  } catch (e) {}
+});
diff --git a/assets/nav-current.js b/assets/nav-current.js
new file mode 100644
index 0000000..1c8ba27
--- /dev/null
+++ b/assets/nav-current.js
@@ -0,0 +1,3 @@
+for (const a of document.querySelectorAll('.🗺 a')) {
+  if (location.href === a.href) a.classList.add('current');
+}
diff --git a/pages/index.html b/pages/index.html
index a96ac9d..39c977c 100644
--- a/pages/index.html
+++ b/pages/index.html
@@ -19,19 +19,7 @@ <h2>Next event</h2>
         <time class="⏰" datetime="{{start_time}}">
           {{ start_time | date_to_long_string }}
 
-          <span>
-            <script>
-              document.currentScript.replaceWith(
-                document.createTextNode(
-                  new Intl.DateTimeFormat('default', {
-                    hour: 'numeric',
-                    minute: 'numeric',
-                    timeZoneName: 'long'
-                  })
-                    .format(new Date("{{start_time}}"))
-                )
-              )
-            </script>
+          <span class="local-time">
             <noscript>
               {{ start_time | date: "%k:%M%P %Z" }}
             </noscript>
diff --git a/pages/podcast.md b/pages/podcast.md
index 9ecd824..f99bc56 100644
--- a/pages/podcast.md
+++ b/pages/podcast.md
@@ -27,4 +27,4 @@ _Or_, subscribe on Spotify:
 
 You can hear the latest published episode here: 
 
-<iframe src="https://open.spotify.com/embed-podcast/show/2ppoyoTxxSv9IvRGGqLWP7" width="100%" height="232" frameborder="0" allowtransparency="true" allow="encrypted-media" title="Spotify Podcast player - Airquotes the Podcast Airquotes"></iframe>
\ No newline at end of file
+<iframe src="https://open.spotify.com/embed-podcast/show/2ppoyoTxxSv9IvRGGqLWP7" width="100%" height="232" frameborder="0" allowtransparency="true" allow="encrypted-media" title="Spotify Podcast player - Airquotes the Podcast Airquotes" sandbox="allow-scripts allow-same-origin allow-presentation"></iframe>
\ No newline at end of file
