Mirror the openvidu.io hardening: heading outline, template escaping, Dependabot

.github/dependabot.yml

@@ -4,3 +4,10 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+
+  # The dev image's base tag, which must stay in step with openvidu.io's.
+  - package-ecosystem: "docker"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"

docs/tutorials/application-server/dotnet.md

@@ -107,7 +107,7 @@ Finally the application enables CORS support and the port where the application
 
 ---
 
-#### Create token
+### Create token
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -162,7 +162,7 @@ Finally, the returned token is sent back to the client.
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

docs/tutorials/application-server/java.md

@@ -79,7 +79,7 @@ Going deeper, the `Controller` class has the following fields:
 
 ---
 
-#### Create token
+### Create token
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -121,7 +121,7 @@ If required fields are available, a new JWT token is created. For that we use th
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

docs/tutorials/application-server/node.md

@@ -85,7 +85,7 @@ Finally the `express` application is initialized. CORS is allowed, JSON body par
 
 ---
 
-#### Create token
+### Create token
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -127,7 +127,7 @@ If required fields are available, a new JWT token is created. For that we use th
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

docs/tutorials/application-server/php.md

@@ -79,7 +79,7 @@ The `index.php` file imports the required dependencies, sets the HTTP headers fo
 
 ---
 
-#### Create token
+### Create token
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -131,7 +131,7 @@ If required fields are available, a new JWT token is created. For that we use th
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

docs/tutorials/application-server/python.md

@@ -83,7 +83,7 @@ Finally the `Flask` application is initialized and CORS support is enabled.
 
 ---
 
-#### Create token
+### Create token
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -123,7 +123,7 @@ If required fields are available, a new JWT token is created. For that we use th
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

docs/tutorials/application-server/ruby.md

@@ -86,7 +86,7 @@ Finally the application configures the port, sets the CORS configuration for Sin
 
 ---
 
-#### Create token endpoint
+### Create token endpoint
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -128,7 +128,7 @@ If required fields are available, a new JWT token is created. For that we use th
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

docs/tutorials/application-server/rust.md

@@ -102,7 +102,7 @@ Then CORS support is enabled and the endpoints are defined. Finally the `axum` a
 
 ---
 
-#### Create token endpoint
+### Create token endpoint
 
 The endpoint `/token` accepts `POST` requests with a payload of type `application/json`, containing the following fields:
 
@@ -181,7 +181,7 @@ If required fields are available, a new JWT token is created. For that we use th
 
 ---
 
-#### Receive webhook
+### Receive webhook
 
 The endpoint `/livekit/webhook` accepts `POST` requests with a payload of type `application/webhook+json`. This is the endpoint where LiveKit Server will send [webhook events :fontawesome-solid-external-link:{.external-link-icon}](https://openvidu.io/latest/docs/reference/webhooks/#events){:target="_blank"}.
 

overrides/main.html

@@ -14,7 +14,11 @@
    The style is gated on an attribute rather than removed: navigation.instant
    diffs the <head> and re-appends any tag the live head is missing, so a
    removed style would come back on every instant navigation with nothing to
-   remove it again — hiding the body. #}
+   remove it again — hiding the body.
+   Known limit: the <noscript> fallback below shows the body again when scripts
+   are off, which includes a framer using <iframe sandbox> without allow-scripts.
+   That is accepted so JS-off visitors still get a page; the content is public
+   and nothing here acts on the visitor's behalf. #}
 <style id="antiClickjack">html:not([data-unframed]) body{display:none !important;}</style>
 <script>
   if (self === top) {
@@ -53,8 +57,11 @@
 
 {% include "partials/og.html" %}
 {% include "partials/json-ld.html" %}
+{# Pages cannot send a Referrer-Policy header; the meta form is the browsers' default made
+   explicit: full URL to same-origin, origin only to other sites, nothing on downgrade. #}
+<meta name="referrer" content="strict-origin-when-cross-origin" />
 {% if page.meta and page.meta.robots %}
-<meta name="robots" content="{{ page.meta.robots }}" />
+<meta name="robots" content="{{ page.meta.robots | e }}" />
 {% endif %}
 {% endblock %}
 

overrides/partials/footer.html

@@ -32,7 +32,7 @@
                 {{ direction }}
               </span>
               <div class="md-ellipsis">
-                {{ page.previous_page.title }}
+                {{ page.previous_page.title | e }}
               </div>
             </div>
           </a>
@@ -51,7 +51,7 @@
                 {{ direction }}
               </span>
               <div class="md-ellipsis">
-                {{ page.next_page.title }}
+                {{ page.next_page.title | e }}
               </div>
             </div>
             <div class="md-footer__button md-icon">
@@ -84,10 +84,9 @@ <h4>NEWSLETTER</h4>
             <div style="width:100%; padding-top: .4rem;">
                 <div id="mc_embed_signup">
                     <form action="//openvidu.us16.list-manage.com/subscribe/post?u=5cccadc0d9ef9bab689a3c70f&amp;id=43f63ba2f8" method="post"
-                      id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" class="validate" target="_blank" novalidate>
-                      <div class="form-validation alert"></div>
+                      id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" target="_blank">
                       <div id="mc_embed_signup_scroll" class="form-group subscribe-form-input" style="display: flex; flex-wrap: wrap; gap: 10px;">
-                          <input type="email" value="" name="EMAIL" class="email footer-subscribe-input" id="mce-EMAIL" placeholder="Email Address" required style="flex: 1 1 120px; min-width: 0;">
+                          <input type="email" value="" name="EMAIL" class="footer-subscribe-input" id="mce-EMAIL" placeholder="Email Address" aria-label="Email address" required style="flex: 1 1 120px; min-width: 0;">
                           {# real people should not fill this in and expect good things - do not remove this or risk form bot signups #}
                           <div style="position: absolute; left: -5000px;" aria-hidden="true"><input type="text" name="b_5cccadc0d9ef9bab689a3c70f_43f63ba2f8" tabindex="-1" value=""></div>
                           <div class="md-typeset" style="flex-shrink: 0;"><input type="submit" value="Subscribe" name="subscribe" id="mc-embedded-subscribe" class="md-button"></div>