Page 1 of 1
Should remove polyfill.io script
Posted: Tue Jul 09, 2024 3:10 am
by zakariamouhid
this script is used on each problem page
https://projecteuler.net/problem=1
Code: Select all
<script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script>
polyfill.io service is not safe anymore
https://www.kaspersky.com/blog/polyfill ... cks/51635/
use this alternative
https://cdnjs.cloudflare.com/polyfill/
Code: Select all
<script src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?version=4.8.0&features=es6"></script>
Re: Should remove polyfill.io script
Posted: Tue Jul 09, 2024 5:53 pm
by euler
Many thanks for the heads-up and the really useful links. I have changed the scripts here (.chat), the main site (.net), and our backup website (.info) to use the safe alternative.
Re: Should remove polyfill.io script
Posted: Thu Jul 11, 2024 3:14 am
by zakariamouhid
euler wrote: Tue Jul 09, 2024 5:53 pm
Many thanks for the heads-up and the really useful links. I have changed the scripts here (.chat), the main site (.net), and our backup website (.info) to use the safe alternative.
should also update the Content-Security-Policy http header from
Code: Select all
Content-Security-Policy: script-src 'self' https://cdn.jsdelivr.net/gh/highlightjs/ https://cdn.jsdelivr.net/npm/mathjax@3/ https://polyfill.io/v3/;style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/gh/highlightjs/ https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css;
to
Code: Select all
Content-Security-Policy: script-src 'self' https://cdn.jsdelivr.net/gh/highlightjs/ https://cdn.jsdelivr.net/npm/mathjax@3/ https://cdnjs.cloudflare.com/polyfill/v3/;style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/gh/highlightjs/ https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css;
Re: Should remove polyfill.io script
Posted: Thu Jul 11, 2024 9:32 pm
by euler
I'd missed that. Thanks.