<commit_before>defmodule ErlefWeb.Router do
  use ErlefWeb, :router
  use Honeybadger.Plug
  import Phoenix.LiveDashboard.Router

  @trusted_sources ~w(
    use.fontawesome.com platform.twitter.com syndication.twitter.com
    syndication.twitter.com/settings cdn.syndication.twimg.com
    licensebuttons.net i.creativecommons.org
    pbs.twimg.com use.typekit.net p.typekit.net
    avatar-images.ewr1.vultrobjects.com event-org-images.ewr1.vultrobjects.com 
    sponsors.ewr1.vultrobjects.com erlef.matomo.cloud cdn.rawgit.com
    127.0.0.1:9998 cdn.datatables.net user.fm cdnjs.cloudflare.com uicdn.toast.com
  )

  @trusted_connect_sources ~w(https://user.fm https://www.erlef.org wss://erlef.org 
    wss://www.erlef.org ws://erlef.org ws://www.erlef.org  https://erlef.matomo.cloud https://raw.githubusercontent.com)

  if Erlef.in_env?([:dev, :test]) do
    @default_source Enum.join(@trusted_sources ++ ["127.0.0.1:9998"], " ")
    @default_connect_source Enum.join(@trusted_connect_sources ++ ["127.0.0.1:9998"], " ")
  else
    @default_source Enum.join(@trusted_sources, " ")
    @default_connect_source Enum.join(@trusted_connect_sources, " ")
  end

  @connect_src "connect-src 'self' #{@default_connect_source}"

  @csp "default-src 'self' 'unsafe-eval' 'unsafe-inline' data: #{@default_source}; #{@connect_src}"

  pipeline :api do
    plug :accepts, ["json"]
    plug ErlefWeb.Plug.RemoteAddr
    plug ErlefWeb.Plug.API.Auth
  end

  pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_live_flash
    plug :protect_from_forgery
    plug ErlefWeb.Plug.Attack
    plug ErlefWeb.Plug.RemoteAddr
    plug ErlefWeb.Plug.Session
    plug :put_secure_browser_headers, %{"content-security-policy" => @csp}
    plug ErlefWeb.Plug.Sponsors<commit_msg>Add plausible.io as a trusted source for CSP (#265)<commit_after>defmodule ErlefWeb.Router do
  use ErlefWeb, :router
  use Honeybadger.Plug
  import Phoenix.LiveDashboard.Router

  @trusted_sources ~w(
    use.fontawesome.com platform.twitter.com syndication.twitter.com
    syndication.twitter.com/settings cdn.syndication.twimg.com
    licensebuttons.net i.creativecommons.org
    pbs.twimg.com use.typekit.net p.typekit.net
    avatar-images.ewr1.vultrobjects.com event-org-images.ewr1.vultrobjects.com 
    sponsors.ewr1.vultrobjects.com erlef.matomo.cloud cdn.rawgit.com
    127.0.0.1:9998 cdn.datatables.net user.fm cdnjs.cloudflare.com uicdn.toast.com
    plausible.io
  )

  @trusted_connect_sources ~w(https://user.fm https://www.erlef.org wss://erlef.org 
    wss://www.erlef.org ws://erlef.org ws://www.erlef.org  https://plausible.io https://raw.githubusercontent.com)

  if Erlef.in_env?([:dev, :test]) do
    @default_source Enum.join(@trusted_sources ++ ["127.0.0.1:9998"], " ")
    @default_connect_source Enum.join(@trusted_connect_sources ++ ["127.0.0.1:9998"], " ")
  else
    @default_source Enum.join(@trusted_sources, " ")
    @default_connect_source Enum.join(@trusted_connect_sources, " ")
  end

  @connect_src "connect-src 'self' #{@default_connect_source}"

  @csp "default-src 'self' 'unsafe-eval' 'unsafe-inline' data: #{@default_source}; #{@connect_src}"

  pipeline :api do
    plug :accepts, ["json"]
    plug ErlefWeb.Plug.RemoteAddr
    plug ErlefWeb.Plug.API.Auth
  end

  pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_live_flash
    plug :protect_from_forgery
    plug ErlefWeb.Plug.Attack
    plug ErlefWeb.Plug.RemoteAddr
    plug ErlefWeb.Plug.Session
    plug :put_secure_browser_headers, %{"content-security-policy" => @csp}
    plug ErlefWeb.Plug.Sponsors
{'fraction_non_alphanumeric': 0.13157170382603908, 'fraction_numerical': 0.018992568125516102, 'mean_word_length': 3.9577080491132333, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 8, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1037545', 'n_tokens_mistral': 1417, 'n_tokens_neox': 1348, 'n_words': 216}