cmd/files.go

@@ -11,7 +11,6 @@ import (
 	"math/rand/v2"
 	"os"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"slices"
 	"strings"

cmd/index.go

@@ -5,6 +5,7 @@ Copyright © 2024 Seednode <seednode@seedno.de>
 package cmd
 
 import (
+	"bytes"
 	"encoding/gob"
 	"encoding/json"
 	"fmt"
@@ -57,7 +58,7 @@ func makeTree(list []string) ([]byte, error) {
 		return []byte{}, err
 	}
 
-	return resp, nil
+	return bytes.ReplaceAll(resp, []byte(": null"), []byte{}), nil
 }
 
 func (index *fileIndex) List() []string {

cmd/root.go

@@ -17,7 +17,7 @@ import (
 
 const (
 	AllowedCharacters string = `^[A-z0-9.\-_]+$`
-	ReleaseVersion    string = "8.7.2"
+	ReleaseVersion    string = "8.7.0"
 )
 
 var (

cmd/web.go

@@ -312,11 +312,7 @@ func serveMedia(paths []string, index *fileIndex, filename *regexp.Regexp, forma
 			return
 		}
 
-		// Temporarily disabled until I figure out how to make things
-		// work properly with inline event handlers.
-		// nonce := format.CSP(w)
-		nonce := ""
-
+		nonce := format.CSP(w)
 
 		mediaType := format.MediaType(filepath.Ext(path))
 

go.mod

@@ -15,5 +15,5 @@ require (
 	github.com/dlclark/regexp2 v1.10.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/net v0.20.0 // indirect
 )

go.sum

@@ -24,7 +24,7 @@ github.com/yosssi/gohtml v0.0.0-20201013000340-ee4748c638f4 h1:0sw0nJM544SpsihWx
 github.com/yosssi/gohtml v0.0.0-20201013000340-ee4748c638f4/go.mod h1:+ccdNT0xMY1dtc5XBxumbYfOUhmduiGudqaDgD2rVRE=
 golang.org/x/image v0.15.0 h1:kOELfmgrmJlw4Cdb7g/QGuB3CvDrXbqEIww/pNtNBm8=
 golang.org/x/image v0.15.0/go.mod h1:HUYqC05R2ZcZ3ejNQsIHQDQiwWM4JBqmm6MKANTp4LE=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

vendor/golang.org/x/net/html/token.go

@@ -910,6 +910,9 @@ func (z *Tokenizer) readTagAttrKey() {
 			return
 		}
 		switch c {
+		case ' ', '\n', '\r', '\t', '\f', '/':
+			z.pendingAttr[0].end = z.raw.end - 1
+			return
 		case '=':
 			if z.pendingAttr[0].start+1 == z.raw.end {
 				// WHATWG 13.2.5.32, if we see an equals sign before the attribute name
@@ -917,9 +920,7 @@ func (z *Tokenizer) readTagAttrKey() {
 				continue
 			}
 			fallthrough
-		case ' ', '\n', '\r', '\t', '\f', '/', '>':
-			// WHATWG 13.2.5.33 Attribute name state
-			// We need to reconsume the char in the after attribute name state to support the / character
+		case '>':
 			z.raw.end--
 			z.pendingAttr[0].end = z.raw.end
 			return
@@ -938,11 +939,6 @@ func (z *Tokenizer) readTagAttrVal() {
 	if z.err != nil {
 		return
 	}
-	if c == '/' {
-		// WHATWG 13.2.5.34 After attribute name state
-		// U+002F SOLIDUS (/) - Switch to the self-closing start tag state.
-		return
-	}
 	if c != '=' {
 		z.raw.end--
 		return

vendor/modules.txt

@@ -39,7 +39,7 @@ golang.org/x/image/riff
 golang.org/x/image/vp8
 golang.org/x/image/vp8l
 golang.org/x/image/webp
-# golang.org/x/net v0.21.0
+# golang.org/x/net v0.20.0
 ## explicit; go 1.18
 golang.org/x/net/html
 golang.org/x/net/html/atom