Skip to content

Commit 050679d

Browse files
spivanatalie64spivanatalie64
committed
Security audit fixes: CSP nonces, CORS tightening, PBKDF2 hashing, admin timing-safe compare, remove auto-merge, add _headers, migrate inline handlers, back-to-top.js, fix HTML validation (alt text, button types, void elements, unescaped &)
Signed-off-by: Natalie Spiva <natalie@acreetionos.org>
1 parent 5468a1a commit 050679d

40 files changed

Lines changed: 367 additions & 330 deletions

‎32bit.html‎

Lines changed: 5 additions & 5 deletions
Large diffs are not rendered by default.

‎404.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!DOCTYPE html><html lang="en"><head>
2-
<meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="referrer" content="strict-origin-when-cross-origin" /><title>404 - Page Not Found - AcreetionOS</title><meta name="description" content="The page you are looking for does not exist. Return to AcreetionOS homepage." /><meta name="robots" content="noindex, follow" /><link rel="canonical" href="https://acreetionos.org/" /><meta property="og:title" content="404 - Page Not Found - AcreetionOS" /><meta property="og:description" content="The page you are looking for does not exist." /><meta property="og:image" content="https://acreetionos.org/logo.webp" /><meta property="og:url" content="https://acreetionos.org/404.html" /><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="404 - Page Not Found - AcreetionOS" /><meta name="twitter:description" content="The page you are looking for does not exist." /><meta name="twitter:image" content="https://acreetionos.org/logo.webp" /><link rel="icon" type="image/webp" href="acreetionoslogo.webp"><link rel="preconnect" href="https://fonts.googleapis.com" crossorigin><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Fira+Code&family=Roboto:wght@400;500;700&display=swap" rel="stylesheet">
2+
<meta charset="UTF-8" ><meta name="viewport" content="width=device-width, initial-scale=1.0" ><meta name="referrer" content="strict-origin-when-cross-origin" ><title>404 - Page Not Found - AcreetionOS</title><meta name="description" content="The page you are looking for does not exist. Return to AcreetionOS homepage." ><meta name="robots" content="noindex, follow" ><link rel="canonical" href="https://acreetionos.org/" ><meta property="og:title" content="404 - Page Not Found - AcreetionOS" ><meta property="og:description" content="The page you are looking for does not exist." ><meta property="og:image" content="https://acreetionos.org/logo.webp" ><meta property="og:url" content="https://acreetionos.org/404.html" ><meta name="twitter:card" content="summary" ><meta name="twitter:title" content="404 - Page Not Found - AcreetionOS" ><meta name="twitter:description" content="The page you are looking for does not exist." ><meta name="twitter:image" content="https://acreetionos.org/logo.webp" ><link rel="icon" type="image/webp" href="acreetionoslogo.webp"><link rel="preconnect" href="https://fonts.googleapis.com" crossorigin><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Fira+Code&family=Roboto:wght@400;500;700&display=swap" rel="stylesheet">
33
<style>body{background:#121212;color:#e5e5e5;font-family:'Roboto',sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;text-align:center;padding:2rem}h1{font-size:6rem;color:#2ecc71;font-family:'Fira Code',monospace;margin:0;line-height:1}h2{color:#e5e5e5;margin:1rem 0 0.5rem}p{color:#b2b2b2;max-width:400px;margin-bottom:1.5rem}.btn{display:inline-block;padding:0.8rem 1.5rem;background:#2ecc71;color:#111;border-radius:12px;text-decoration:none;font-weight:700;transition:0.2s}.btn:hover{background:#27ae60;transform:translateY(-2px)}</style>
44
</head><body>
55
<h1>404</h1>

‎_headers‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
/*
2+
X-Frame-Options: DENY
3+
X-Content-Type-Options: nosniff
4+
Referrer-Policy: strict-origin-when-cross-origin
5+
Permissions-Policy: browsing-topics=(), interest-cohort=()
6+
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

‎ask.html‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
<!DOCTYPE html>
22
<html lang="en">
33
<head>
4-
<meta charset="UTF-8" />
5-
<meta name="robots" content="index, follow" />
6-
<meta name="robots" content="index, follow" />
7-
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
8-
<meta name="referrer" content="strict-origin-when-cross-origin" />
9-
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; connect-src 'self' https://api.github.com; media-src 'self' blob:; base-uri 'self';" />
4+
<meta charset="UTF-8" >
5+
<meta name="robots" content="index, follow" >
6+
<meta name="robots" content="index, follow" >
7+
<meta name="viewport" content="width=device-width, initial-scale=1.0" >
8+
<meta name="referrer" content="strict-origin-when-cross-origin" >
9+
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; connect-src 'self' https://api.github.com; media-src 'self' blob:; base-uri 'self';" >
1010
<title>Ask AIDEN - AcreetionOS AI Assistant</title>
11-
<meta name="description" content="Ask AIDEN anything about AcreetionOS. Real-time AI conversation about installation, features, privacy, and more." />
12-
<meta name="keywords" content="AcreetionOS AI, Linux AI assistant, AIDEN, ask about AcreetionOS" />
13-
<link rel="canonical" href="https://acreetionos.org/ask.html" />
14-
<meta property="og:type" content="website" />
15-
<meta property="og:url" content="https://acreetionos.org/ask.html" />
16-
<meta property="og:title" content="Ask AIDEN - AcreetionOS AI Assistant" />
17-
<meta property="og:description" content="Have a real conversation with AIDEN, the AcreetionOS AI assistant." />
18-
<meta property="og:image" content="https://acreetionos.org/logo.webp" />
19-
<link rel="icon" type="image/webp" href="acreetionoslogo.webp" />
20-
<link rel="preconnect" href="https://fonts.googleapis.com" />
21-
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
22-
<link href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&family=Fira+Code&display=swap" rel="stylesheet" media="print" onload="this.media='all'" />
11+
<meta name="description" content="Ask AIDEN anything about AcreetionOS. Real-time AI conversation about installation, features, privacy, and more." >
12+
<meta name="keywords" content="AcreetionOS AI, Linux AI assistant, AIDEN, ask about AcreetionOS" >
13+
<link rel="canonical" href="https://acreetionos.org/ask.html" >
14+
<meta property="og:type" content="website" >
15+
<meta property="og:url" content="https://acreetionos.org/ask.html" >
16+
<meta property="og:title" content="Ask AIDEN - AcreetionOS AI Assistant" >
17+
<meta property="og:description" content="Have a real conversation with AIDEN, the AcreetionOS AI assistant." >
18+
<meta property="og:image" content="https://acreetionos.org/logo.webp" >
19+
<link rel="icon" type="image/webp" href="acreetionoslogo.webp" >
20+
<link rel="preconnect" href="https://fonts.googleapis.com" >
21+
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin >
22+
<link href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&family=Fira+Code&display=swap" rel="stylesheet" media="print" onload="this.media='all'" >
2323
<style>
2424
:root {
2525
--green: #2ecc71;
@@ -375,7 +375,7 @@
375375
<div id="perm-banner" style="display:none;position:fixed;top:0;left:0;right:0;z-index:2000;background:#2c1a00;border-bottom:2px solid #f39c12;padding:0.6rem 1.5rem;align-items:center;gap:0.75rem;font-size:0.85rem;color:#f39c12">
376376
<span>⚠️</span>
377377
<span>Microphone access is blocked. To use voice features, allow microphone access in your browser's site settings and reload.</span>
378-
<button onclick="this.parentElement.style.display='none'" style="margin-left:auto;background:transparent;border:1px solid #f39c12;color:#f39c12;border-radius:8px;padding:0.2rem 0.6rem;cursor:pointer">Dismiss</button>
378+
<button type="button" onclick="this.parentElement.style.display='none'" style="margin-left:auto;background:transparent;border:1px solid #f39c12;color:#f39c12;border-radius:8px;padding:0.2rem 0.6rem;cursor:pointer">Dismiss</button>
379379
</div>
380380

381381
<!-- ── Chat Mode ── -->
@@ -388,7 +388,7 @@
388388
<div class="chat-sub">AcreetionOS AI Assistant</div>
389389
</div>
390390
</div>
391-
<button id="live-btn">
391+
<button type="button" id="live-btn">
392392
<span class="live-dot"></span>
393393
Go Live
394394
</button>
@@ -397,18 +397,18 @@
397397
<div id="messages"></div>
398398

399399
<div class="suggestions" id="suggestions">
400-
<button class="suggestion-chip">What is AcreetionOS?</button>
401-
<button class="suggestion-chip">How do I install it?</button>
402-
<button class="suggestion-chip">What is XLibre?</button>
403-
<button class="suggestion-chip">Vs Manjaro?</button>
404-
<button class="suggestion-chip">System requirements?</button>
405-
<button class="suggestion-chip">Is it beginner friendly?</button>
400+
<button type="button" class="suggestion-chip">What is AcreetionOS?</button>
401+
<button type="button" class="suggestion-chip">How do I install it?</button>
402+
<button type="button" class="suggestion-chip">What is XLibre?</button>
403+
<button type="button" class="suggestion-chip">Vs Manjaro?</button>
404+
<button type="button" class="suggestion-chip">System requirements?</button>
405+
<button type="button" class="suggestion-chip">Is it beginner friendly?</button>
406406
</div>
407407

408408
<div id="input-row">
409-
<input id="chat-input" type="text" placeholder="Ask AIDEN anything about AcreetionOS…" autocomplete="off" />
410-
<button class="icon-btn" id="mic-btn" title="Voice input">🎙</button>
411-
<button id="send-btn" title="Send">&#x27A4;</button>
409+
<input id="chat-input" type="text" placeholder="Ask AIDEN anything about AcreetionOS…" autocomplete="off" >
410+
<button type="button" class="icon-btn" id="mic-btn" title="Voice input">🎙</button>
411+
<button type="button" id="send-btn" title="Send">&#x27A4;</button>
412412
</div>
413413
</div>
414414

@@ -418,18 +418,18 @@
418418
<div class="live-brand-name">
419419
AIDEN <span class="live-badge">LIVE</span>
420420
</div>
421-
<button id="end-live-btn">End conversation</button>
421+
<button type="button" id="end-live-btn">End conversation</button>
422422
<select id="audio-device-select" title="Audio output device"></select>
423423
</div>
424424

425425
<canvas id="orb-canvas"></canvas>
426426
<div id="live-status">Tap the orb to start</div>
427427
<div id="voice-dots">
428-
<button class="voice-dot" data-voice="0" title="Nova — warm and natural" style="--dot-color:#2ecc71"></button>
429-
<button class="voice-dot" data-voice="1" title="Echo — proper and articulate" style="--dot-color:#3498db"></button>
430-
<button class="voice-dot" data-voice="2" title="Ember — casual and direct" style="--dot-color:#e67e22"></button>
431-
<button class="voice-dot" data-voice="3" title="Atlas — deep and confident" style="--dot-color:#9b59b6"></button>
432-
<button class="voice-dot" data-voice="4" title="Iris — bright and cheerful" style="--dot-color:#e74c3c"></button>
428+
<button type="button" class="voice-dot" data-voice="0" title="Nova — warm and natural" aria-label="Nova — warm and natural" style="--dot-color:#2ecc71"></button>
429+
<button type="button" class="voice-dot" data-voice="1" title="Echo — proper and articulate" aria-label="Echo — proper and articulate" style="--dot-color:#3498db"></button>
430+
<button type="button" class="voice-dot" data-voice="2" title="Ember — casual and direct" aria-label="Ember — casual and direct" style="--dot-color:#e67e22"></button>
431+
<button type="button" class="voice-dot" data-voice="3" title="Atlas — deep and confident" aria-label="Atlas — deep and confident" style="--dot-color:#9b59b6"></button>
432+
<button type="button" class="voice-dot" data-voice="4" title="Iris — bright and cheerful" aria-label="Iris — bright and cheerful" style="--dot-color:#e74c3c"></button>
433433
</div>
434434
<div id="interrupt-hint">Tap the orb or speak to interrupt</div>
435435

‎back-to-top.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
document.addEventListener('DOMContentLoaded', function() {
2+
var btn = document.getElementById('back-to-top');
3+
if (!btn) return;
4+
btn.addEventListener('click', function() {
5+
window.scrollTo({ top: 0, behavior: 'smooth' });
6+
});
7+
window.addEventListener('scroll', function() {
8+
if (window.scrollY > 400) {
9+
btn.classList.add('visible');
10+
} else {
11+
btn.classList.remove('visible');
12+
}
13+
});
14+
});

0 commit comments

Comments
 (0)