workers/feed-types.mjs

Functions

Imports

It imports no other module of this repo. Imported by workers/app.ts.

Source

1/**
2 * Content types that get no CSP: a feed or sitemap is parsed, never rendered as a document (a PDF is shown by the
3 * browser's own viewer), so a policy there is bytes on every shared-cached response that protect nothing. Named
4 * types, never a negation of text/html, so an unforeseen document type keeps its policy. Safe only while
5 * `nosniff` stays on every response.
6 */
7
8/** @type {ReadonlySet<string>} */
9export const UNPOLICED_TYPES = new Set([
10  "application/rss+xml",
11  "application/atom+xml",
12  "application/json",
13  "application/xml",
14  // The CV PDF (app/routes/cv-pdf.ts). Its address was a static asset, which carried no policy, and a policy on
15  // a PDF protects nothing (it is no page of this site) while a `sandbox` or `object-src` directive can stop the
16  // browser's own PDF viewer from opening it.
17  "application/pdf",
18]);
19
20/**
21 * @param {string | null} contentType
22 * @returns {boolean}
23 */
24export function isUnpolicedType(contentType) {
25  if (!contentType) return false;
26  const type = (contentType.split(";")[0] ?? "").trim().toLowerCase();
27  return UNPOLICED_TYPES.has(type);
28}