Repository navigation
IndieWeb: representative h-card + complete rel=me set - #48
Merged
Merged
Conversation
Following the IndieWeb walkthrough at en.andros.dev, mark up the homepage identity as a representative microformats2 h-card and close the rel=me gap. - Wrap the name + lede in a div.h-card: p-name on the h1, p-org on Archetype, u-url u-uid on the "this site" link -> https://aadhar.sh/. url == uid == page URL makes it a representative h-card, so parsers (IndieWebify, Bridgy, webmention senders) resolve identity to the domain. Class + rel attributes only, no visual change, no JS. It's the mf2 twin of the schema.org Person JSON-LD already in <head>. - Add rel="external me" links for LinkedIn and GitHub to the footer list. LinkedIn had no rel=me anywhere (was only in JSON-LD sameAs), so identity consolidation was incomplete. No u-photo: the site ships no headshot on purpose, and an mf2 h-card is valid on name + url alone. Verified with mf2py: 1 h-card (name/org/url/uid), rel=me now 7 profiles. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
aadhar-sh | 9f630a9 | Jul 20 2026, 06:03 PM |
Contributor
Understanding-first reviewThis is a prompt, not a score or merge gate. Before approving, reconstruct the change:
For docs and dependency changes, a compact answer is enough. For behavior or production changes, include the causal path and one concrete counterexample. The author’s claim card belongs in the PR description; this prompt is for the reviewer’s independent reconstruction. |
oddharsh
added a commit
that referenced
this pull request
Aug 12, 2026
* fix: close the tag-stripping gaps CodeQL keeps finding All 15 open code-scanning alerts are the same 15 that were triaged and dismissed months ago. They came back because #340 renamed holding/ to www/, lwe-pipeline/ to pipelines/lwe/, and moved build.mjs and contract-tests.mjs into scripts/. CodeQL tracks an alert by file path, so every dismissal whose file moved reset to open. The alerts on files that stayed put, in scripts/lib/html-to-md.mjs and check-page-contracts.mjs, are still dismissed, which is what confirms the cause. So this fixes the 11 where fixing is cheaper than re-dismissing, and leaves 4 that no code change should touch. The security half of every old dismissal still holds: lensMarkdown returns JSON that reaches the DOM through esc(), an excerpt is stored escaped, and contentOf feeds link extraction rather than rendering. What those dismissals conceded was a FIDELITY cost, and that part is real and now fixed. `</script >` is a legal end tag and `--!>` legally closes a comment, so a stripper spelled `</script>` or `-->` hands the body through: script source lands in a markdown render, and minified JS lands in a webmention excerpt a human reads. www/_worker.js/lens.js \s* on the closer, --!> on the comment, and \b so <head> stops swallowing a page that opens with <header> and runs to the next literal </head> www/_worker.js/webmention.js same closers in excerptAround www/_worker.js/webmention-send.js same closers in contentOf pipelines/lwe/generate.mjs replaceAll on the accent's #, and --!> on the console.log marker strip scripts/build.mjs escape the backslash and the rest of the metacharacters before turning * into .* lensStripTags loops, and the comment at it says plainly that one pass of /<[^>]+>/g is already a fixpoint: the match runs from a < to the next >, so a surviving < has no > after it and a second pass cannot match. The loop is for CodeQL, which cannot see that argument, and for whoever narrows the pattern later, where the proof stops holding. Better to write that down than to claim a fix the code does not make. The contract test fails if either closer regex goes back, verified by reverting one. Left open deliberately, because the right resolution is a dismissal: #51 www/garage/horizon.html the unsafe parse IS the demo, setHTMLUnsafe beside setHTML on the visitor's own textarea #48 #49 #50 contract-tests two of these are Array.prototype.includes on a list of extracted citations, so they are not string operations at all, let alone URL checks Suite 240 pass, build, pages:check, typecheck, and 130 routes all green. * fix: end tags carry attributes, and one strip pass can re-form what it removes CodeQL re-scanned the changed lines and found two things the first pass got wrong. Both are real, and the second is the interesting one. An end tag may carry attributes. `</script bar>` closes a script element as surely as `</script>` does, so `<\/script\s*>` was still handing the body through, just for a narrower set of inputs than before. Every closer in lensMarkdown, excerptAround and contentOf is `<\/tag\b[^>]*>` now. Removing a span can RE-FORM the thing being removed out of what is left on either side. `<!-` + `<!--x-->` + `-` collapses to `<!--` the moment the middle goes, so one pass leaves a live comment opener behind. The contract test asserts that collapse directly before asserting the fix, so it demonstrates the bug rather than asserting around it. What explains the split in the alerts is the REPLACEMENT, not the pattern. The webmention strippers replace with a space, which keeps the two sides from touching and makes them immune for free; that is why CodeQL never flagged them for this and flagged lens.js twice. lensMarkdown replaces with "" to preserve markdown spacing, so it pays for that with a fixpoint loop instead. The old lensStripTags is now a general untilStable(s, re, repl) covering all five strips, and the comment at it says which of the two problems each caller has. pipelines/lwe/generate.mjs builds its console.log label by allowlisting the wordy part of the marker rather than denylisting delimiters it has to remember. Output is byte-identical on all four call sites, checked against the old form. Suite 242 pass, build, pages:check, typecheck, 130 routes all green. * fix: keep the end-tag fix, drop the fixpoint loops that fixed nothing The loops in the previous commit were wrong and the measurement is why. Keeping the reasoning in the file so it is not re-argued every time this moves. CodeQL wants a fixpoint loop on each strip in lensMarkdown, because removing a span can re-form what was removed out of what is left either side. That really happens here: one pass of the comment strip over `<p>a<!-<!--x-->-</p>` leaves `<p>a<!--</p>`, since the match starts at the INNER opener. It is unreachable anyway, twice over. The re-formed opener is eaten by the generic `<[^>]+>` strip further down, because `<!--</p>` matches whole. And that strip is itself already a fixpoint: its match runs from a `<` to the next `>`, so any `<` surviving a pass has no `>` after it and a second pass cannot match. The bill for looping all three, measured on one 256KB fixture, node, same V8: 6.29ms against 5.94ms median. Roughly 10% of the CPU-bound half of a scan, on the exact path LENS_PARSE_CAP exists to keep under the 10ms Workers ceiling. Real money for a bug nothing can reach, so the loops are out and the four lens.js multi-character alerts want a dismissal instead. The contract test I wrote for the loops is out with them. It passed with the loops reverted, which made it decoration, and this repo has the scar tissue to know better. The two end-tag tests stay and both fail when their fix is reverted, verified. What survives from that commit is the part that was real. An end tag may carry attributes, so `</script bar>` closes a script element as surely as `</script>` does, and `<\/script\s*>` was still handing the body through. Every closer in lensMarkdown, excerptAround and contentOf is `<\/tag\b[^>]*>` now. Suite 241 pass, build, pages:check, typecheck, 130 routes all green. --------- Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Marks up the homepage identity for the IndieWeb, following the walkthrough at en.andros.dev. Two markup-only changes to
holding/index.html, no visual change and no JS.What changed
<div class="h-card">:p-nameon the<h1>,p-orgon Archetype,u-url u-uidon the "this site" link pointing tohttps://aadhar.sh/. Becauseurl == uid == page URL, it's a representative h-card, so parsers (IndieWebify, Bridgy, webmention senders) resolve the identity to the domain. It's the microformats2 twin of the schema.org Person JSON-LD already in<head>.rel="external me"links for LinkedIn and GitHub to the footer list. LinkedIn had norel=meanywhere before (it was only in the JSON-LDsameAs), so identity consolidation was incomplete. The set is now 7 profiles.Why no
u-photoThe article lists photo as the third "minimum" field, but the site ships no headshot on purpose (it's a photography site, not selfies), and an mf2 h-card is valid on name + url alone. Didn't fabricate one.
Verification
Parsed with
mf2py:name/org/url/uid, andurl == uid == https://aadhar.sh/(representative).rel=meresolves to 7 profiles: Twitter, Instagram, LinkedIn, GitHub, Curius, Beli, Spotify.Reviewer note: the reciprocal half is manual
rel=meonly verifies once each profile links back tohttps://aadhar.sh. GitHub reads that from the profile "Website" field (the one most tooling checks); LinkedIn and Twitter/X no longer honor rel=me, so those are consolidation-only. That's account-settings work on each platform, not in this diff. Run indiewebify.me once the back-links are set.Left as optional (not in this PR)
h-entry on
/writingposts (awkward on the Notepad<textarea>model), webmention endpoint (needs a receiver), IndieAuth / Micropub / WebSub (the article's author skipped these for a git/markdown workflow), and RSS/h-feed.🤖 Generated with Claude Code