Skip to content

Commit

Permalink
fix: flaws in Mozilla/Add-ons batch 2 (#1869)
Browse files Browse the repository at this point in the history
  • Loading branch information
nschonni authored Jan 29, 2021
1 parent 2ea5038 commit b3eebdd
Show file tree
Hide file tree
Showing 59 changed files with 234 additions and 234 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -450,7 +450,7 @@ <h2 id="Prevent_some_browsers_from_MIME-sniffing_the_response">Prevent some brow
<li><strong><code>upgrade-insecure-requests</code> does not ensure HTTPS for the top-level navigation. If you want to force the website itself to be loaded over HTTPS you must include the <code>Strict-Transport-Security</code> header</strong></li>
</ul>
</li>
<li>Includes the <code>Content-Security-Policy</code> header in all responses that are able to execute scripting. This includes the commonly used file types: HTML, XML and PDF documents. Although Javascript files can not execute scripts in a "browsing context", they are included to target <a href="/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#CSP_in_workers">web workers</a></li>
<li>Includes the <code>Content-Security-Policy</code> header in all responses that are able to execute scripting. This includes the commonly used file types: HTML, XML and PDF documents. Although Javascript files can not execute scripts in a "browsing context", they are included to target <a href="/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#csp_in_workers">web workers</a></li>
</ol>

<p>Some older browsers would try and guess the content type of a resource, even when it isn't properly set up on the server configuration. This reduces exposure to drive-by download attacks and cross-origin data leaks.</p>
Expand Down
8 changes: 4 additions & 4 deletions files/en-us/learn/server-side/django/models/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -412,8 +412,8 @@ <h2 id="Re-run_the_database_migrations">Re-run the database migrations</h2>

<p>All your models have now been created. Now re-run your database migrations to add them to your database.</p>

<pre class="brush: bash notranslate"><code>python3 manage.py makemigrations
python3 manage.py migrate</code></pre>
<pre class="brush: bash notranslate">python3 manage.py makemigrations
python3 manage.py migrate</pre>

<h2 id="Language_model_—_challenge">Language model — challenge</h2>

Expand All @@ -430,8 +430,8 @@ <h2 id="Language_model_—_challenge">Language model — challenge</h2>

<p>Don't forget that after a change to your model, you should again re-run your database migrations to add the changes.</p>

<pre class="brush: bash notranslate"><code>python3 manage.py makemigrations</code><code>
python3 manage.py migrate</code></pre>
<pre class="brush: bash notranslate">python3 manage.py makemigrations
python3 manage.py migrate</pre>

<h2 id="Summary">Summary</h2>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ <h2 id="Overview">Overview</h2>
<h2 id="Creating_the_project">Creating the project</h2>

<ol>
<li>Open a command shell (or a terminal window), and make sure you are in your <a href="/en-US/docs/Learn/Server-side/Django/development_environment#Using_a_virtual_environment">virtual environment</a></li>
<li>Open a command shell (or a terminal window), and make sure you are in your <a href="/en-US/docs/Learn/Server-side/Django/development_environment#using_a_virtual_environment">virtual environment</a></li>
<li>Navigate <span style="line-height: 1.5;">to where you want to store your Django apps (make it somewhere easy to find like inside your <em>Documents</em> folder), and create a folder for your new website (in this case: </span><em>django_projects</em>). Then change into your newly-created directory:
<pre class="brush: bash notranslate">mkdir django_projects
cd django_projects</pre>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -386,7 +386,7 @@ <h4 id="Get_dependencies_and_re-test">Get dependencies and re-test</h4>
<pre class="brush: bash">npm install
</pre>

<p>Now run the site (see <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/routes#Testing_the_routes">Testing the routes</a> for the relevant commands) and check that the site still behaves as you expect.</p>
<p>Now run the site (see <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/routes#testing_the_routes">Testing the routes</a> for the relevant commands) and check that the site still behaves as you expect.</p>

<h4 id="Save_changes_to_Github">Save changes to Github</h4>

Expand Down Expand Up @@ -454,7 +454,7 @@ <h3 id="Setting_configuration_variables">Setting configuration variables</h3>
NODE_ENV: production
</pre>

<p>We should also use a separate database for production, setting its URI in the <strong>MONGODB_URI</strong>  environment variable. You can set up a new database and database-user exactly <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/mongoose#Setting_up_the_MongoDB_database">as we did originally</a>, and get its URI. You can set the URI as shown (obviously, using your own URI!)</p>
<p>We should also use a separate database for production, setting its URI in the <strong>MONGODB_URI</strong>  environment variable. You can set up a new database and database-user exactly <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/mongoose#setting_up_the_mongodb_database">as we did originally</a>, and get its URI. You can set the URI as shown (obviously, using your own URI!)</p>

<pre class="brush: bash">&gt;heroku config:set <strong>MONGODB_URI</strong>='mongodb+srv://cooluser:coolpassword@cluster0-mbdj7.mongodb.net/local_library?retryWrites=true'
Setting MONGODB_URI and restarting limitless-tor-18923... done, v13
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ <h2 class="highlight-spanned" id="View"><span class="highlight-span">View</span>

<h2 class="highlight-spanned" id="What_does_it_look_like"><span class="highlight-span">What does it look like?</span></h2>

<p>Run the application (see <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/routes#Testing_the_routes">Testing the routes</a> for the relevant commands) and open your browser to <a class="external external-icon" href="http://localhost:3000/" rel="noopener">http://localhost:3000/</a>. Then select the <em>All books</em> link. If everything is set up correctly, your site should look something like the following screenshot.</p>
<p>Run the application (see <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/routes#testing_the_routes">Testing the routes</a> for the relevant commands) and open your browser to <a class="external external-icon" href="http://localhost:3000/" rel="noopener">http://localhost:3000/</a>. Then select the <em>All books</em> link. If everything is set up correctly, your site should look something like the following screenshot.</p>

<p><img alt="Book List Page - Express Local Library site" src="new_book_list.png" style="border-style: solid; border-width: 1px; display: block; margin: 0px auto;"></p>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ <h2 id="Controller">Controller</h2>
}</strong>
</pre>

<p>The message will then propagate through to our error handling code (this was set up when we <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/skeleton_website#error_handling">generated the app skeleton</a> - for more information see <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/Introduction#Handling_errors">Handling Errors</a>).</p>
<p>The message will then propagate through to our error handling code (this was set up when we <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/skeleton_website#error_handling">generated the app skeleton</a> - for more information see <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/Introduction#handling_errors">Handling Errors</a>).</p>
</div>

<p>The rendered view is <strong>genre_detail</strong> and it is passed variables for the <code>title</code>, <code>genre</code> and the list of books in this genre (<code>genre_books</code>).</p>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@

<p>The template uses (and includes) JavaScript and CSS from <a class="external external-icon" href="http://getbootstrap.com/" rel="noopener">Bootstrap</a> to improve the layout and presentation of the HTML page. Using Bootstrap or another client-side web framework is a quick way to create an attractive page that can scale well on different browser sizes, and it also allows us to deal with the page presentation without having to get into any of the details—we just want to focus on the server-side code here!</p>

<p>The layout should be fairly obvious if you've read our above <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/Displaying_data#Template_primer">Template primer</a>. Note the use of <code>block content</code> as a placeholder for where the content for our individual pages will be placed.</p>
<p>The layout should be fairly obvious if you've read our above <a href="/en-US/docs/Learn/Server-side/Express_Nodejs/Displaying_data#template_primer">Template primer</a>. Note the use of <code>block content</code> as a placeholder for where the content for our individual pages will be placed.</p>

<p>The base template also references a local css file (<strong>style.css</strong>) that provides a little additional styling. Open <strong>/public/stylesheets/style.css</strong> and replace its content with the following CSS code:</p>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ <h3 id="Static_sites">Static sites</h3>

<p>The diagram below shows a basic web server architecture for a <em>static site</em> (a static site is one that returns the same hard-coded content from the server whenever a particular resource is requested). When a user wants to navigate to a page, the browser sends an HTTP "GET" request specifying its URL.</p>

<p>The server retrieves the requested document from its file system and returns an HTTP response containing the document and a <a href="/en-US/docs/Web/HTTP/Status#Successful_responses">success status</a> (usually 200 OK). If the file cannot be retrieved for some reason, an error status is returned (see <a href="/en-US/docs/Web/HTTP/Status#Client_error_responses">client error responses</a> and <a href="/en-US/docs/Web/HTTP/Status#Server_error_responses">server error responses</a>).</p>
<p>The server retrieves the requested document from its file system and returns an HTTP response containing the document and a <a href="/en-US/docs/Web/HTTP/Status#successful_responses">success status</a> (usually 200 OK). If the file cannot be retrieved for some reason, an error status is returned (see <a href="/en-US/docs/Web/HTTP/Status#client_error_responses">client error responses</a> and <a href="/en-US/docs/Web/HTTP/Status#server_error_responses">server error responses</a>).</p>

<p><img alt="A simplified diagram of a static web server." src="basic_static_app_server.png"></p>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ <h2 id="A_simple_button">A simple button</h2>

}</pre>

<p>This specifies that we'll have a <a href="/en-US/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Background_scripts">background script</a> named "background.js", and a browser action (button) whose icons will live in the "icons" directory.</p>
<p>This specifies that we'll have a <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#background_scripts">background script</a> named "background.js", and a browser action (button) whose icons will live in the "icons" directory.</p>

<div class="pull-aside">
<div class="moreinfo">These icons are from the <a href="https://www.iconfinder.com/iconsets/bitsies">bitsies!</a> iconset created by Recep Kütük.</div>
Expand All @@ -55,8 +55,8 @@ <h2 id="A_simple_button">A simple button</h2>
<p>Next, create the "icons" directory inside the "buttons" directory, and save the two icons shown below inside it:</p>

<ul>
<li>"page-16.png" (<img alt="" src="https://mdn.mozillademos.org/files/13476/page-16.png" style="height: 16px; width: 16px;">)</li>
<li>"page-32.png" (<img alt="" src="https://mdn.mozillademos.org/files/13478/page-32.png" style="height: 32px; width: 32px;">).</li>
<li>"page-16.png" (<img alt="" src="page-16.png">)</li>
<li>"page-32.png" (<img alt="" src="page-32.png">).</li>
</ul>

<p>We have two icons so we can use the bigger one in high-density displays. The browser will take care of selecting the best icon for the current display.</p>
Expand All @@ -82,7 +82,7 @@ <h2 id="A_simple_button">A simple button</h2>
background.js
manifest.json</code></pre>

<p>Now <a href="https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Temporary_Installation_in_Firefox">install the extension</a> and click the button:</p>
<p>Now <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Temporary_Installation_in_Firefox">install the extension</a> and click the button:</p>

<p>{{EmbedYouTube("kwwTowgT-Ys")}}</p>

Expand Down Expand Up @@ -191,7 +191,7 @@ <h2 id="Adding_a_popup">Adding a popup</h2>

<h2 id="Page_actions">Page actions</h2>

<p><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Page_actions">Page actions</a> are just like browser actions, except that they are for actions which are relevant only for particular pages, rather than the browser as a whole.</p>
<p><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/user_interface/Page_actions">Page actions</a> are just like browser actions, except that they are for actions which are relevant only for particular pages, rather than the browser as a whole.</p>

<p>While browser actions are always shown, page actions are only shown in tabs where they are relevant. Page action buttons are displayed in the URL bar, rather than the browser toolbar.</p>

Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -15,19 +15,19 @@ <h2 id="manifest.json">manifest.json</h2>
<p>The manifest can also contain pointers to several other types of files:</p>

<dl>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Background_scripts">Background scripts</a></dt>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#background_scripts">Background scripts</a></dt>
<dd>Implement long-running logic.</dd>
<dt>Icons</dt>
<dd>For the extension and any buttons it might define.</dd>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Sidebars_popups_and_options_pages">Sidebars, popups, and options pages</a>:</dt>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#sidebars_popups_and_options_pages">Sidebars, popups, and options pages</a>:</dt>
<dd>HTML documents that provide content for various user interface components.</dd>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Content_scripts">Content scripts</a></dt>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#content_scripts">Content scripts</a></dt>
<dd>JavaScript included with your extension, that you will inject into web pages.</dd>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Web_accessible_resources">Web-accessible resources</a></dt>
<dt><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#web_accessible_resources">Web-accessible resources</a></dt>
<dd>Make packaged content accessible to web pages and content scripts.</dd>
</dl>

<p><img alt="" src="https://mdn.mozillademos.org/files/13669/webextension-anatomy.png" style="display: block; height: 581px; margin-left: auto; margin-right: auto; width: 600px;"></p>
<p><img alt="" src="webextension-anatomy.png" style="display: block; margin-left: auto; margin-right: auto;"></p>

<p>See the <code><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json">manifest.json</a></code> reference page for all the details.</p>

Expand All @@ -37,7 +37,7 @@ <h2 id="Background_scripts">Background scripts</h2>

<p>Extensions often need to maintain long-term state or perform long-term operations independently of the lifetime of any particular web page or browser window. That is what background scripts are for.</p>

<p>Background scripts are loaded as soon as the extension is loaded and stay loaded until the extension is disabled or uninstalled. You can use any of the <a href="/en-US/Add-ons/WebExtensions/API">WebExtension APIs</a> in the script, as long as you have requested the necessary <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions">permissions</a>.</p>
<p>Background scripts are loaded as soon as the extension is loaded and stay loaded until the extension is disabled or uninstalled. You can use any of the <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/API">WebExtension APIs</a> in the script, as long as you have requested the necessary <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions">permissions</a>.</p>

<h3 id="Specifying_background_scripts">Specifying background scripts</h3>

Expand Down Expand Up @@ -86,15 +86,15 @@ <h4 id="DOM_APIs">DOM APIs</h4>

<h4 id="WebExtension_APIs">WebExtension APIs</h4>

<p>Background scripts can use any of the <a href="/en-US/Add-ons/WebExtensions/API">WebExtension APIs</a> in the script, as long as their extension has the necessary <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions">permissions</a>.</p>
<p>Background scripts can use any of the <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/API">WebExtension APIs</a> in the script, as long as their extension has the necessary <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions">permissions</a>.</p>

<h4 id="Cross-origin_access">Cross-origin access</h4>

<p>Background scripts can make XHR requests to any hosts for which they have <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions">host permissions</a>.</p>

<h4 id="Web_content">Web content</h4>

<p>Background scripts do not get direct access to web pages. However, they can load <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts">content scripts</a> into web pages and can <a href="/en-US/Add-ons/WebExtensions/Content_scripts#Communicating_with_background_scripts">communicate with these content scripts using a message-passing API</a>.</p>
<p>Background scripts do not get direct access to web pages. However, they can load <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts">content scripts</a> into web pages and can <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts#communicating_with_background_scripts">communicate with these content scripts using a message-passing API</a>.</p>

<h4 id="Content_security_policy">Content security policy</h4>

Expand Down Expand Up @@ -140,7 +140,7 @@ <h2 id="Content_scripts">Content scripts</h2>
<ul>
<li>Make cross-domain XHR requests.</li>
<li>Use a small subset of the <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/API">WebExtension APIs</a>.</li>
<li><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts#Communicating_with_background_scripts">Exchange messages with their background scripts</a> and can in this way indirectly access all the WebExtension APIs.</li>
<li><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts#communicating_with_background_scripts">Exchange messages with their background scripts</a> and can in this way indirectly access all the WebExtension APIs.</li>
</ul>

<p>Content scripts cannot directly access normal page scripts but can exchange messages with them using the standard <code><a href="/en-US/docs/Web/API/Window/postMessage">window.postMessage()</a></code> API.</p>
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
---
<div>{{AddonSidebar}}</div>

<p><span class="seoSummary">Schedule code to run at a specific time in the future.</span> This is like <code><a href="/en-US/docs/Web/API/WindowTimers/setTimeout">setTimeout()</a></code> and <code><a href="/en-US/docs/Web/API/WindowTimers/setInterval">setInterval()</a></code>, except that those functions don't work with background pages that are loaded on demand. Alarms do not persist across browser sessions.</p>
<p><span class="seoSummary">Schedule code to run at a specific time in the future.</span> This is like <code><a href="/en-US/docs/Web/API/WindowOrWorkerGlobalScope/setTimeout">setTimeout()</a></code> and <code><a href="/en-US/docs/Web/API/WindowOrWorkerGlobalScope/setInterval">setInterval()</a></code>, except that those functions don't work with background pages that are loaded on demand. Alarms do not persist across browser sessions.</p>

<p>To use this API you need to have the "alarms" <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions">permission</a>.</p>

Expand Down
Loading

0 comments on commit b3eebdd

Please sign in to comment.