is not the first of its type. if (element.matches("title:is(:nth-of-type(n+2))")) return true; // <base> is not the first of its type. if (element.matches("base:has(~ base), base ~ base")) return true; // CSP meta tag anywhere. if ((0, $9c3989fcb9437829$export$14b1a2f64a600585)(element)) return true; // Invalid http-equiv. if ($580f7ed6bc170ae8$var$isInvalidHttpEquiv(element)) return true; // Invalid meta viewport. if ($580f7ed6bc170ae8$var$isInvalidMetaViewport(element)) return true; // Invalid default-style. if ($580f7ed6bc170ae8$var$isInvalidDefaultStyle(element)) return true; // Invalid character encoding. if ($580f7ed6bc170ae8$var$isInvalidContentType(element)) return true; // Origin trial expired, or invalid origin. if ($580f7ed6bc170ae8$var$isInvalidOriginTrial(element)) return true; // Preload is unnecessary. if ($580f7ed6bc170ae8$var$isUnnecessaryPreload(element)) return true; return false; } function $580f7ed6bc170ae8$export$b01ab94d0cd042a0(head) { const validationWarnings = []; const titleElements = Array.from(head.querySelectorAll("title")); const titleElementCount = titleElements.length; if (titleElementCount != 1) validationWarnings.push({ warning: `Expected exactly 1 <title> element, found ${titleElementCount}`, elements: titleElements }); const metaViewport = head.querySelectorAll('meta[name="viewport" i]'); if (metaViewport.length != 1) validationWarnings.push({ warning: `Expected exactly 1 <meta name=viewport> element, found ${metaViewport.length}` }); const baseElements = Array.from(head.querySelectorAll("base")); const baseElementCount = baseElements.length; if (baseElementCount > 1) validationWarnings.push({ warning: `Expected at most 1 <base> element, found ${baseElementCount}`, elements: baseElements }); const metaCSP = head.querySelector('meta[http-equiv="Content-Security-Policy" i]'); if (metaCSP) validationWarnings.push({ warning: "CSP meta tags disable the preload scanner due to a bug in Chrome. Use the CSP header instead. Learn more: https://crbug.com/1458493", element: metaCSP }); head.querySelectorAll("*").forEach((element)=>{ if ($580f7ed6bc170ae8$export$a8257692ac88316c(element)) return; let root = element; while(root.parentElement != head)root = root.parentElement; validationWarnings.push({ warning: `${element.tagName} elements are not allowed in the <head>`, element: root }); }); const originTrials = Array.from(head.querySelectorAll('meta[http-equiv="Origin-Trial" i]')); originTrials.forEach((element)=>{ const metadata = $580f7ed6bc170ae8$var$validateOriginTrial(element); if (metadata.warnings.length == 0) return; validationWarnings.push({ warning: `Invalid origin trial token: ${metadata.warnings.join(", ")}`, elements: [ element ], element: metadata.payload }); }); return validationWarnings; } function $580f7ed6bc170ae8$export$6c93e2175c028eeb(element) { if ((0, $9c3989fcb9437829$export$38a04d482ec50f88)(element)) return $580f7ed6bc170ae8$var$validateOriginTrial(element); if ((0, $9c3989fcb9437829$export$14b1a2f64a600585)(element)) return $580f7ed6bc170ae8$var$validateCSP(element); if ($580f7ed6bc170ae8$var$isDefaultStyle(element)) return $580f7ed6bc170ae8$var$validateDefaultStyle(element); if ($580f7ed6bc170ae8$var$isMetaViewport(element)) return $580f7ed6bc170ae8$var$validateMetaViewport(element); if ($580f7ed6bc170ae8$var$isContentType(element)) return $580f7ed6bc170ae8$var$validateContentType(element); if ($580f7ed6bc170ae8$var$isHttpEquiv(element)) return $580f7ed6bc170ae8$var$validateHttpEquiv(element); if ($580f7ed6bc170ae8$var$isUnnecessaryPreload(element)) return $580f7ed6bc170ae8$var$validateUnnecessaryPreload(element); return {}; } function $580f7ed6bc170ae8$var$validateCSP(element) { const warnings = []; let payload = null; if (element.matches('meta[http-equiv="Content-Security-Policy-Report-Only" i]')) { //https://w3c.github.io/webappsec-csp/#meta-element warnings.push("CSP Report-Only is forbidden in meta tags"); return warnings; } if (element.matches('meta[http-equiv="Content-Security-Policy" i]')) warnings.push("meta CSP discouraged. See https://crbug.com/1458493."); const content = element.getAttribute("content"); if (!content) { warnings.push("Invalid CSP. The content attribute must be set."); return { warnings: warnings, payload: payload }; } const directives = Object.fromEntries(content.split(/\s*;\s*/).map((directive)=>{ const [key, ...value] = directive.split(" "); return [ key, value.join(" ") ]; })); payload = payload ?? {}; payload.directives = directives; if ("report-uri" in directives) warnings.push("The report-uri directive is not supported. Use the Content-Security-Policy-Report-Only HTTP header instead."); if ("frame-ancestors" in directives) warnings.push("The frame-ancestors directive is not supported. Use the Content-Security-Policy HTTP header instead."); if ("sandbox" in directives) warnings.push("The sandbox directive is not supported. Use the Content-Security-Policy HTTP header instead."); return { warnings: warnings, payload: payload }; } function $580f7ed6bc170ae8$var$isInvalidOriginTrial(element) { if (!(0, $9c3989fcb9437829$export$38a04d482ec50f88)(element)) return false; const { warnings: warnings } = $580f7ed6bc170ae8$var$validateOriginTrial(element); return warnings.length > 0; } function $580f7ed6bc170ae8$var$validateOriginTrial(element) { const metadata = { payload: null, warnings: [] }; const token = element.getAttribute("content"); try { metadata.payload = $580f7ed6bc170ae8$var$decodeOriginTrialToken(token); } catch { metadata.warnings.push("invalid token"); return metadata; } if (metadata.payload.expiry < new Date()) metadata.warnings.push("expired"); if (!$580f7ed6bc170ae8$var$isSameOrigin(metadata.payload.origin, document.location.href)) { const subdomain = $580f7ed6bc170ae8$var$isSubdomain(metadata.payload.origin, document.location.href); // Cross-origin OTs are only valid if: // 1. The document is a subdomain of the OT origin and the isSubdomain config is set // 2. The isThirdParty config is set if (subdomain && !metadata.payload.isSubdomain) metadata.warnings.push("invalid subdomain"); else if (!subdomain && !metadata.payload.isThirdParty) metadata.warnings.push("invalid third-party origin"); } return metadata; } // Adapted from https://glitch.com/~ot-decode. function $580f7ed6bc170ae8$var$decodeOriginTrialToken(token) { const buffer = new Uint8Array([ ...atob(token) ].map((a)=>a.charCodeAt(0))); const view = new DataView(buffer.buffer); const length = view.getUint32(65, false); const payload = JSON.parse(new TextDecoder().decode(buffer.slice(69, 69 + length))); payload.expiry = new Date(payload.expiry * 1000); return payload; } function $580f7ed6bc170ae8$var$isSameOrigin(a, b) { return new URL(a).origin === new URL(b).origin; } // Whether b is a subdomain of a function $580f7ed6bc170ae8$var$isSubdomain(a, b) { // www.example.com ends with .example.com a = new URL(a); b = new URL(b); return b.host.endsWith(`.${a.host}`); } function $580f7ed6bc170ae8$var$isDefaultStyle(element) { return element.matches('meta[http-equiv="default-style" i]'); } function $580f7ed6bc170ae8$var$isContentType(element) { return element.matches($580f7ed6bc170ae8$export$2f975f13375faaa1); } function $580f7ed6bc170ae8$var$isHttpEquiv(element) { return element.matches($580f7ed6bc170ae8$export$9739336dee0b3205); } function $580f7ed6bc170ae8$var$isMetaViewport(element) { return element.matches('meta[name="viewport" i]'); } function $580f7ed6bc170ae8$var$isInvalidDefaultStyle(element) { if (!$580f7ed6bc170ae8$var$isDefaultStyle(element)) return false; const { warnings: warnings } = $580f7ed6bc170ae8$var$validateDefaultStyle(element); return warnings.length > 0; } function $580f7ed6bc170ae8$var$isInvalidContentType(element) { if (!$580f7ed6bc170ae8$var$isContentType(element)) return false; const { warnings: warnings } = $580f7ed6bc170ae8$var$validateContentType(element); return warnings.length > 0; } function $580f7ed6bc170ae8$var$isInvalidHttpEquiv(element) { if (!$580f7ed6bc170ae8$var$isHttpEquiv(element)) return false; const { warnings: warnings } = $580f7ed6bc170ae8$var$validateHttpEquiv(element); return warnings.length > 0; } function $580f7ed6bc170ae8$var$isInvalidMetaViewport(element) { if (!$580f7ed6bc170ae8$var$isMetaViewport(element)) return false; const { warnings: warnings } = $580f7ed6bc170ae8$var$validateMetaViewport(element); return warnings.length > 0; } function $580f7ed6bc170ae8$var$isUnnecessaryPreload(element) { if (!element.matches($580f7ed6bc170ae8$export$5540ac2a18901364)) return false; const href = element.getAttribute("href"); if (!href) return false; const preloadedUrl = $580f7ed6bc170ae8$var$absolutifyUrl(href); return $580f7ed6bc170ae8$var$findElementWithSource(element.parentElement, preloadedUrl) != null; } function $580f7ed6bc170ae8$var$findElementWithSource(root, sourceUrl) { const linksAndScripts = Array.from(root.querySelectorAll(`link:not(${$580f7ed6bc170ae8$export$5540ac2a18901364}), script`)); return linksAndScripts.find((e)=>{ const src = e.getAttribute("href") || e.getAttribute("src"); if (!src) return false; return sourceUrl == $580f7ed6bc170ae8$var$absolutifyUrl(src); }); } function $580f7ed6bc170ae8$var$absolutifyUrl(href) { return new URL(href, document.baseURI).href; } function $580f7ed6bc170ae8$var$validateDefaultStyle(element) { const warnings = []; let payload = null; // Check if the value points to an alternate stylesheet with that title const title = element.getAttribute("content"); const stylesheet = element.parentElement.querySelector(`link[rel~="alternate" i][rel~="stylesheet" i][title="${title}"]`); if (!title) warnings.push("This has no effect. The content attribute must be set to a valid stylesheet title."); else if (!stylesheet) { payload = { alternateStylesheets: Array.from(element.parentElement.querySelectorAll('link[rel~="alternate" i][rel~="stylesheet" i]')) }; warnings.push(`This has no effect. No alternate stylesheet found having title="${title}".`); } warnings.push("Even when used correctly, the default-style method of setting a preferred stylesheet results in a flash of unstyled content. Use modern CSS features like @media rules instead."); return { warnings: warnings, payload: payload }; } function $580f7ed6bc170ae8$var$validateContentType(element) { const warnings = []; let payload = null; // https://html.spec.whatwg.org/multipage/semantics.html#character-encoding-declaration // Check if there exists both meta[http-equiv] and meta[chartset] variations if (element.matches(':is(meta[charset] ~ meta[http-equiv="content-type" i])') || element.matches(":has(~ meta[charset])")) { const encodingDeclaration = element.parentElement.querySelector("meta[charset]"); payload = payload ?? {}; payload.encodingDeclaration = encodingDeclaration; warnings.push(`There can only be one meta-based character encoding declaration per document. Already found \`${encodingDeclaration.outerHTML}\`.`); } // Check if it compeltely exists in the first 1024 bytes const charPos = element.ownerDocument.documentElement.outerHTML.indexOf(element.outerHTML) + element.outerHTML.length; if (charPos > 1024) { payload = payload ?? {}; payload.characterPosition = charPos; warnings.push(`The element containing the character encoding declaration must be serialized completely within the first 1024 bytes of the document. Found at byte ${charPos}.`); } // Check that the character encoding is UTF-8 let charset = null; if (element.matches("meta[charset]")) charset = element.getAttribute("charset"); else { const charsetPattern = /text\/html;\s*charset=(.*)/i; charset = element.getAttribute("content")?.match(charsetPattern)?.[1]?.trim(); } if (charset?.toLowerCase() != "utf-8") { payload = payload ?? {}; payload.charset = charset; warnings.push(`Documents are required to use UTF-8 encoding. Found "${charset}".`); } if (warnings.length) // Append the spec source to the last warning warnings[warnings.length - 1] += "\nLearn more: https://html.spec.whatwg.org/multipage/semantics.html#character-encoding-declaration"; return { warnings: warnings, payload: payload }; } function $580f7ed6bc170ae8$var$validateHttpEquiv(element) { const warnings = []; const type = element.getAttribute("http-equiv").toLowerCase(); const content = element.getAttribute("content")?.toLowerCase(); switch(type){ case "content-security-policy": case "content-security-policy-report-only": case "origin-trial": case "content-type": case "default-style": break; case "refresh": if (!content) { warnings.push("This doesn't do anything. The content attribute must be set. However, using refresh is discouraged."); break; } if (content.includes("url=")) warnings.push("Meta auto-redirects are discouraged. Use HTTP 3XX responses instead."); else warnings.push("Meta auto-refreshes are discouraged unless users have the ability to disable it."); break; case "x-dns-prefetch-control": if (content == "on") warnings.push(`DNS prefetching is enabled by default. Setting it to "${content}" has no effect.`); else if (content != "off") warnings.push(`This is a non-standard way of disabling DNS prefetching, which is a performance optimization. Found content="${content}". Use content="off" if you have a legitimate security concern, otherwise remove it.`); else warnings.push("This is non-standard, however most browsers support disabling speculative DNS prefetching. It should still be noted that DNS prefetching is a generally accepted performance optimization and you should only disable it if you have specific security concerns."); break; case "cache-control": case "etag": case "pragma": case "expires": case "last-modified": warnings.push("This doesn't do anything. Use HTTP headers for any cache directives."); break; case "x-frame-options": warnings.push("This doesn't do anything. Use the CSP HTTP header with the frame-ancestors directive instead."); break; case "x-ua-compatible": case "content-style-type": case "content-script-type": case "imagetoolbar": case "cleartype": case "page-enter": case "page-exit": case "site-enter": case "site-exit": case "msthemecompatible": case "window-target": warnings.push("This doesn't do anything. It was an Internet Explorer feature and is now deprecated."); break; case "content-language": case "language": warnings.push("This is non-conforming. Use the html[lang] attribute instead."); break; case "set-cookie": warnings.push("This is non-conforming. Use the Set-Cookie HTTP header instead."); break; case "application-name": case "author": case "description": case "generator": case "keywords": case "referrer": case "theme-color": case "color-scheme": case "viewport": case "creator": case "googlebot": case "publisher": case "robots": warnings.push(`This doesn't do anything. Did you mean \`meta[name=${type}]\`?`); break; case "encoding": warnings.push("This doesn't do anything. Did you mean `meta[charset]`?"); break; case "title": warnings.push("This doesn't do anything. Did you mean to use the `title` tag instead?"); break; case "accept-ch": case "delegate-ch": warnings.push("This is non-standard and may not work across browsers. Use HTTP headers instead."); break; default: warnings.push("This is non-standard and may not work across browsers. http-equiv is not an alternative to HTTP headers."); break; } return { warnings: warnings }; } function $580f7ed6bc170ae8$var$validateMetaViewport(element) { const warnings = []; let payload = null; // Redundant meta viewport validation. if (element.matches('meta[name="viewport" i] ~ meta[name="viewport" i]')) { const firstMetaViewport = element.parentElement.querySelector('meta[name="viewport" i]'); payload = { firstMetaViewport: firstMetaViewport }; warnings.push("Another meta viewport element has already been declared. Having multiple viewport settings can lead to unexpected behavior."); return { warnings: warnings, payload: payload }; } // Additional validation performed only on the first meta viewport. const content = element.getAttribute("content")?.toLowerCase(); if (!content) { warnings.push("Invalid viewport. The content attribute must be set."); return { warnings: warnings, payload: payload }; } const directives = Object.fromEntries(content.split(",").map((directive)=>{ const [key, value] = directive.split("="); return [ key?.trim(), value?.trim() ]; })); if ("width" in directives) { const width = directives["width"]; if (Number(width) < 1 || Number(width) > 10000) warnings.push(`Invalid width "${width}". Numeric values must be between 1 and 10000.`); else if (width != "device-width") warnings.push(`Invalid width "${width}".`); } if ("height" in directives) { const height = directives["height"]; if (Number(height) < 1 || Number(height) > 10000) warnings.push(`Invalid height "${height}". Numeric values must be between 1 and 10000.`); else if (height != "device-height") warnings.push(`Invalid height "${height}".`); } if ("initial-scale" in directives) { const initialScale = Number(directives["initial-scale"]); if (isNaN(initialScale)) warnings.push(`Invalid initial zoom level "${directives["initial-scale"]}". Values must be numeric.`); if (initialScale < 0.1 || initialScale > 10) warnings.push(`Invalid initial zoom level "${initialScale}". Values must be between 0.1 and 10.`); } if ("minimum-scale" in directives) { const minimumScale = Number(directives["minimum-scale"]); if (isNaN(minimumScale)) warnings.push(`Invalid minimum zoom level "${directives["minimum-scale"]}". Values must be numeric.`); if (minimumScale < 0.1 || minimumScale > 10) warnings.push(`Invalid minimum zoom level "${minimumScale}". Values must be between 0.1 and 10.`); } if ("maximum-scale" in directives) { const maxScale = Number(directives["maximum-scale"]); if (isNaN(maxScale)) warnings.push(`Invalid maximum zoom level "${directives["maximum-scale"]}". Values must be numeric.`); if (maxScale < 0.1 || maxScale > 10) warnings.push(`Invalid maximum zoom level "${maxScale}". Values must be between 0.1 and 10.`); if (maxScale < 2) warnings.push(`Disabling zoom levels under 2x can cause accessibility issues. Found "${maxScale}".`); } if ("user-scalable" in directives) { const userScalable = directives["user-scalable"]; if (userScalable == "no" || userScalable == "0") warnings.push(`Disabling zooming can cause accessibility issues to users with visual impairments. Found "${userScalable}".`); if (![ "0", "1", "yes", "no" ].includes(userScalable)) warnings.push(`Unsupported value "${userScalable}" found.`); } if ("interactive-widget" in directives) { const interactiveWidget = directives["interactive-widget"]; const validValues = [ "resizes-visual", "resizes-content", "overlays-content" ]; if (!validValues.includes(interactiveWidget)) warnings.push(`Unsupported value "${interactiveWidget}" found.`); } if ("shrink-to-fit" in directives) warnings.push("The shrink-to-fit directive has been obsolete since iOS 9.2.\n See https://www.scottohara.me/blog/2018/12/11/shrink-to-fit.html"); const validDirectives = new Set([ "width", "height", "initial-scale", "minimum-scale", "maximum-scale", "user-scalable", "interactive-widget" ]); Object.keys(directives).filter((directive)=>{ // shrink-to-fit is not valid, but we have a separate warning for it. return !validDirectives.has(directive) && directive != "shrink-to-fit"; }).forEach((directive)=>{ warnings.push(`Invalid viewport directive "${directive}".`); }); return { warnings: warnings, payload: payload }; } function $580f7ed6bc170ae8$var$validateUnnecessaryPreload(element) { const href = element.getAttribute("href"); const preloadedUrl = $580f7ed6bc170ae8$var$absolutifyUrl(href); const preloadedElement = $580f7ed6bc170ae8$var$findElementWithSource(element.parentElement, preloadedUrl); if (!preloadedElement) throw new Error("Expected an invalid preload, but none found."); return { warnings: [ `This preload has little to no effect. ${href} is already discoverable by another ${preloadedElement.tagName} element.` ] }; } function $0eec6c831ab0f90a$export$8679af897d1c058e(io, validation) { const validationWarnings = validation.getValidationWarnings(io.getHead()); io.logValidationWarnings(validationWarnings); } function $0eec6c831ab0f90a$export$b65597cffe09aebc(io, validation, rules) { const headElement = io.getHead(); const headWeights = rules.getHeadWeights(headElement).map(({ element: element, weight: weight })=>{ return { weight: weight, element: io.getLoggableElement(element), isValid: !validation.hasValidationWarning(element), customValidations: validation.getCustomValidations(element) }; }); io.visualizeHead("Actual", headElement, headWeights); const sortedWeights = Array.from(headWeights).sort((a, b)=>b.weight - a.weight); const sortedHead = document.createElement("head"); sortedWeights.forEach(({ element: element })=>{ sortedHead.appendChild(element.cloneNode(true)); }); io.visualizeHead("Sorted", sortedHead, sortedWeights); return headWeights; } const $fd3091053c5dfffc$var$CAPO_GLOBAL = "__CAPO__"; async function $fd3091053c5dfffc$var$run() { const options = new $5b739339de321a37$exports.Options(self[$fd3091053c5dfffc$var$CAPO_GLOBAL]); const io = new $d410929ede0a2ee4$exports.IO(document, options); await io.init(); $0eec6c831ab0f90a$export$8679af897d1c058e(io, $580f7ed6bc170ae8$exports); $0eec6c831ab0f90a$export$b65597cffe09aebc(io, $580f7ed6bc170ae8$exports, $9c3989fcb9437829$exports); } $fd3091053c5dfffc$var$run(); })();