<commit_before>require './lib/models/session'

class Web < Sinatra::Base
  register Sinatra::Contrib
  helpers Sinatra::Param

  set :raise_sinatra_param_exceptions, true
  set :show_exceptions, false
  set :raise_errors, true

  helpers do
    def title(*args)
      [*args].compact.join(" - ")
    end

    def url(session)
      "/#{session.year}/sessions/#{session.number}"
    end

    def image_url(session)
      case Integer(session.year)
      when 2010, 2011
        "/images/wwdc-#{session.year}.jpg"
      when 2012..2018
        "/images/wwdc-#{session.year}.png"
      else
        nil
      end
    end

    def video_url(session)
      "https://developer.apple.com/videos/wwdc/#{session.year}/?id=#{session.number}"
    end
  end

  before do
    @query = params[:q]

    cache_control :public, max_age: 36000 unless @query

    headers "Content-Security-Policy" => %(
                default-src 'self' *.asciiwwdc.com https://www.google-analytics.com 'unsafe-inline';
                script-src 'self' https://www.google-analytics.com 'sha256-PMVY4aOO1U8gjRTynZgESPfFlcAw8wzp2Ap8YXicf4s=';
                style-src 'self' *.asciiwwdc.com 'unsafe-inline';
                object-src 'none';
                base-uri 'none';
            ).gsub("\n", ' ').squeeze(' ').strip,
            "Link" => %(
                </css/screen.css>; rel=preload; as=style
            ).gsub("\n", ' ').squeeze(' ').strip,
            "Referrer-Policy" => "same-origin",
            "Strict-Transport-Security" => "max-age=63072000; includeSubDomains; preload",
            "X-Content-Type-Options" => "nosniff",
            "X-Frame-Options" => "DENY",
            "X-XSS-Protection" => "1; mode=block" unless settings.development?
  end
<commit_msg>Add frame-ancestors and form-src CSP<commit_after>require './lib/models/session'

class Web < Sinatra::Base
  register Sinatra::Contrib
  helpers Sinatra::Param

  set :raise_sinatra_param_exceptions, true
  set :show_exceptions, false
  set :raise_errors, true

  helpers do
    def title(*args)
      [*args].compact.join(" - ")
    end

    def url(session)
      "/#{session.year}/sessions/#{session.number}"
    end

    def image_url(session)
      case Integer(session.year)
      when 2010, 2011
        "/images/wwdc-#{session.year}.jpg"
      when 2012..2018
        "/images/wwdc-#{session.year}.png"
      else
        nil
      end
    end

    def video_url(session)
      "https://developer.apple.com/videos/wwdc/#{session.year}/?id=#{session.number}"
    end
  end

  before do
    @query = params[:q]

    cache_control :public, max_age: 36000 unless @query

    headers "Content-Security-Policy" => %(
                default-src 'self' *.asciiwwdc.com;
                form-action 'self';
                frame-ancestors 'none';
                script-src 'self' https://www.google-analytics.com 'sha256-PMVY4aOO1U8gjRTynZgESPfFlcAw8wzp2Ap8YXicf4s=';
                style-src 'self' *.asciiwwdc.com;
                object-src 'none';
                base-uri 'none';
            ).gsub("\n", ' ').squeeze(' ').strip,
            "Link" => %(
                </css/screen.css>; rel=preload; as=style
            ).gsub("\n", ' ').squeeze(' ').strip,
            "Referrer-Policy" => "same-origin",
            "Server" => '',
            "Strict-Transport-Security" => "max-age=63072000; includeSubDomains; preload",
            "X-Content-Type-Options" => "nosniff",
            "X-Frame-Options" => "DENY",
            "X-XSS-Protection" => "1; mode=block" unless settings.development?
  end

{'fraction_non_alphanumeric': 0.1517106001121705, 'fraction_numerical': 0.022434099831744252, 'mean_word_length': 2.179144385026738, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 20, 'https://': 5, 'lorem ipsum': 0, 'www.': 3, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1898175', 'n_tokens_mistral': 1273, 'n_tokens_neox': 1170, 'n_words': 212}