Backwards compatibility for browsers without svg support (in this
version) causes the logo to unnecessarily flicker on navigation.
According to caniuse.com SVG in img elements is supported in browsers
used by 97.85% of users. https://caniuse.com/svg-img
Firefox introduced support in 2011, Chrome in 2013, Safari in 2015.
This parameter makes the server return a response with raw file
contents and headers that cause the browser to show a 'save as' dialog.
Regarding Content-Security-Policy:
https://www.w3.org/TR/CSP2/#sandbox-usage
> For example, a message board or email system might provide downloads of
> arbitrary attachments provided by other users. Attacks that rely on tricking
> a client into rendering one of these attachments could be mitigated by
> requesting that resources only be rendered in a very restrictive sandbox.
> Sending the sandbox directive with an empty value establishes such an
> environment:
>
> Content-Security-Policy: sandbox
https://www.w3.org/TR/CSP2/#directive-default-src
> Given this behavior, one good way of building a policy for a site would be to
> begin with a default-src of 'none', and to build up a policy from there that
> contains only those resource types which are actually in use for the page
> you’d like to protect. If you don’t use webfonts, for instance, there’s no
> reason to specify a source list for font-src; specifying only those resource
> types a page uses ensures that the possible attack surface for that page
> remains as small as possible.
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#defense-in-depth
> A strong CSP provides an effective second layer of protection against various
> types of vulnerabilities, especially XSS. Although CSP doesn't prevent web
> applications from containing vulnerabilities, it can make those
> vulnerabilities significantly more difficult for an attacker to exploit.
The idea is to prevent the browser from loading any external resources, if it
turned out it's possible to trick it into interpreting a file as HTML.
for prefix search
https://stackoverflow.com/questions/12348346/berkeley-db-partial-match
This *should* return the same results as the original autocomplete.
Steps the original autocomplete takes to find identifiers:
1. It dumps all keys using db.keys() into a file
query.py:Query.query('keys')
data.py:BsdDB.get_keys()
https://pybsddb.sourceforge.net/bsddb3.html - keys(txn=None)
github.com/virtuozzo/cdn-bsddb3-python/blob/fbb1a877/Lib3/bsddb/dbobj.py#L171
github.com/virtuozzo/cdn-bsddb3-python/blob/fbb1a877/Modules/_bsddb.c#L8565
github.com/virtuozzo/cdn-bsddb3-python/blob/fbb1a877/Modules/_bsddb.c#L3730
seems that this just iterates over the db calling get with DB_NEXT
on the cursor
https://docs.oracle.com/cd/E17276_01/html/api_reference/C/dbcget.html
2. Iterates over the keys, looking for keys that start with provided string.
The script stops when it finds 10 items.
So it's assumed that the order of keys returned by get(DB_NEXT) will make
sense.
This version finds the first key that starts with the prefix using
get(DB_SET_RANGE) and then, just like the previous autocomplete,
iterates over the keys until it finds 10 matching keys.
Now, could get(DB_SET_RANGE) skip keys (ex. point to some other key than
the first key that starts with the prefix)?
I think not - according to the docs, it should point to "the smallest key
greater than or equal to the specified key". The comparison function
determines what "greater or equal" means.
The default comparison function compares keys lexically, with shorter
keys before longer keys.
https://docs.oracle.com/cd/E17276_01/html/api_reference/C/dbset_bt_compare.html
I believe, although I couldn't find precise information about this,
that order of keys when using DB_SET_RANGE shouldn't change.
So tl;dr I'm mostly sure this should work the same way as it worked
before, just faster. There could still be issues with how keys are
ordered in results. The default function seems to just order
characters by byte values.
github.com/berkeleydb/libdb/blob/master/src/btree/bt_compare.c#L154
Also, this allows identifiers sent to autocomplete to contain commas.
* Add requirements.txt with packages used by WSGI Elixir
* Make API compatible with latest Falcon
* Remove remaining global variables from web.py
* Remove Parsed__Path
Falcon passes parsed path segments as arguments to handler methods.
I think it really does not make sense anymore to put that information
back into a tuple just to unpack it again.
* Add RawPathComponent middleware to support encoded slashes
Some paths previously accepted by Elixir can contain encoded slashes.
For example:
/arm-trusted-firmware/sandbox%2Flts-v2.10.3-20240405T0714/source
Falcon by default uses a version of URL that is already decoded. This
default makes parsing said paths impossible.
https://falcon.readthedocs.io/en/v3.1.2/user/recipes/raw-url-path.html
* Move request context building to middleware
* Move validation and unquoting to path converters
* Move base url generation to new functions
Added an ability to customize contents of meta description tag in
templates that inherit from layout. This replaces the default
description previously used in all views.
This change could help with SEO and missing descriptions in search
results (#167). It's based on advice from
https://developers.google.com/search/docs/appearance/snippet
> Create unique descriptions for each page on your site
> Programmatically generate descriptions
This is not guaranteed to fix the issue, search engines are opaque.
All custom descriptions start with "Elixir Cross Referencer - ".
Currently customized descriptions:
* source - path to the file, project name and version
* ident - name of the searched identifier, project name and version
Everything else uses the previous, default description.
Currently, Pygments often picks SLexer for .S files. It's a lexer for
files related to the R language.
https://pygments.org/docs/lexers/#pygments.lexers.r.SLexer
```
>>> import pygments.lexers
>>> pygments.lexers.guess_lexer_for_filename('arch/x86/boot/header.S',
open('arch/x86/boot/header.S').read())
<pygments.lexers.SLexer>
```
This commits makes sure Elixir prefers the GAS lexer for .S files
instead of SLexer.
It's not the best heuristic, but better than picking the SLexer class
sometimes.
Currently, Elixir does not index any R language projects. In the future,
it would be better to specify per-project information about what
languages are used.
Nowadays smartphones are long but narrow. On many devices, the sidebar
is visible (and impossible to hide) in landscape mode.
Long term it would be better to implement sidebar hiding regardless of
device size, but that may require cookies - otherwise some people will
have to hide the sidebar manually on all links.
This commit adds a small piece of Javascript code to force browsers to forget
about incorrectly issued 301 redirects from "latest" versions.
This code only runs for root project paths (i.e. `/linux/v6.10.2/source`, but
not `/linux/v6.10.2/source/arch`) - other links with "latest" will remain
broken for people who visited them (at least until they clear their cache).
* Remove repository indexing from Dockerfile
* Copy Elixir code from the context instead of cloning it from Github
* Move Dockerfile from docker/debian/Dockerfile to docker/Dockerfile
* Add docs for the new Dockerfile
* Add an utility script that allows easier repository configuration
* Add .dockerignore
* Use relative paths in Docker section in README
