From e3680643cfa78366fcccba1f059964d97b04e8c9 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:06:44 +0200
Subject: [PATCH 01/16] wip: add bin/check-rendered, a check on the built site

bin/check-html-safety reads content/, which is the right scope: it is what
an outside contributor can change. But the worst defect found in this
repository lived in a template, so the content was innocent and the check
returned PASS on a payload that rendered a live anchor in the sponsor grid.

This check reads what Hugo built, where a defect of that class is visible
wherever it lives. It parses every built page rather than grepping, because
the site builds with --minify, which unquotes attributes and turns an
escaped entity back into a raw character where that is inert.

Incomplete and not wired into CI yet: no canary fixture, no allowlist
measured against the real tree, and the acceptance test against the
vulnerable template has not been run. Committed as a checkpoint.
---
 bin/check-rendered | 670 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 670 insertions(+)
 create mode 100755 bin/check-rendered

diff --git a/bin/check-rendered b/bin/check-rendered
new file mode 100755
index 00000000..6002ad51
--- /dev/null
+++ b/bin/check-rendered
@@ -0,0 +1,670 @@
+#!/usr/bin/env python3
+"""Find dangerous markup in the built site.
+
+bin/check-html-safety reads content/, which is what an outside contributor
+can change, and it is right to stop there: layouts/, themes/, static/, bin/
+and config.toml are in CODEOWNERS. But the worst defect this project found
+lived in a template. themes/pybcn_theme/layouts/partials/sponsor_summary.html
+assembled the logo markup with printf and emitted it through safeHTML, so the
+sponsor name and the logo URL from front matter reached the page unescaped.
+The content was innocent, the template was not, and check-html-safety
+returned PASS on a payload that rendered a live anchor in the sponsor grid.
+
+This check reads what Hugo built. A bug of that class is visible in the
+output wherever it lives: content, a shortcode, a partial, the theme, a Hugo
+internal template or the minifier.
+
+It parses every .html file under the build directory with html.parser and
+reports:
+
+  - an on* event handler attribute on any element
+  - a javascript:, vbscript: or data: URL in an attribute the browser loads
+    from or navigates to (href, src, srcset, action, formaction, poster and
+    the rest of URL_ATTRIBUTES), in a meta refresh, and in a url() of an
+    inline style
+  - a <script> that is inline, or whose src is not on this site
+  - <iframe>, <object>, <embed>, <base>, an iframe srcdoc, and a <form> or a
+    formaction that posts off this site
+  - a <meta http-equiv="refresh"> that sends the visitor off this site
+  - a style attribute that does more than size, space, align or decorate the
+    element, see SAFE_STYLE. position, z-index, transform, a negative margin
+    or a viewport unit build a page overlay with no script at all
+  - a <style> element that positions, layers, hides or loads, see
+    STYLE_BLOCK_DENY
+  - a <link> that loads a stylesheet or a preload from off this site
+  - an SVG <set> or <animate> that targets an href
+  - any URL on CANARY_HOST, see "The canary" below
+
+Why a parser and not grep. The site builds with --minify, which unquotes
+attributes and turns an escaped entity back into the raw character where
+that is inert. A grep over the built HTML false-positives on
+alt="<img src=x onerror=alert(1)>", which a parser correctly sees as one
+attribute value. A grep also misses &#106;avascript: in an href, which the
+parser decodes the way the browser does, and it cannot tell a <style> that
+is inside an <svg> from one that is not. The parser runs the same rules on
+a minified and on a plain build and gives the same result.
+
+"On this site" means a URL with no host, or a host equal to the one in
+baseURL in config.toml (--host overrides it). The build made by the links
+job uses --baseURL /, so every internal URL there has no host and passes
+the same way.
+
+The canary. content/sponsors/canary.md and content/people/canary.md carry a
+name that is harmless as text and unmistakable as markup: it closes the
+attribute it sits in and opens a link to CANARY_HOST. content/canary.md is a
+draft page that renders both through the real sponsor and people grids. A
+draft is not built without -D, so the production site never carries them,
+and a build made with -D does. The check fails if the canary page is missing
+or if the two names did not reach it as text, so the fixture cannot silently
+disappear. --without-canary scans a build made without -D.
+
+Findings are matched against ALLOWLIST. An entry names the page or the
+directory, the kind of finding, and either the prefix of the URL the element
+loads or the SHA-256 of the inline text, so it permits one known snippet and
+not any later snippet of the same kind.
+
+Exit status:
+  0  no finding outside the allowlist
+  1  at least one finding outside the allowlist, a page that cannot be read,
+     or a canary page that was not built or did not render the fixture
+  2  the build directory does not exist or holds no HTML
+"""
+
+import argparse
+import hashlib
+import os
+import re
+import sys
+from html.parser import HTMLParser
+
+
+# ---------------------------------------------------------------------------
+# The canary
+# ---------------------------------------------------------------------------
+
+# Nothing on the site may point at this host. The two names below put it in
+# a link that only exists if a template printed the name as markup.
+CANARY_HOST = "canary.invalid"
+CANARY_PAGE = "canary/index.html"
+CANARY_NAMES = {
+    "sponsor": 'Canary sponsor "><a href="https://canary.invalid/sponsor">canary</a><span x="',
+    "person": 'Canary person "><a href="https://canary.invalid/person">canary</a><span x="',
+}
+
+
+# ---------------------------------------------------------------------------
+# URLs
+# ---------------------------------------------------------------------------
+
+# Attributes a browser loads a resource from or navigates to. A value in any
+# of them is parsed as a URL and checked for a dangerous scheme and for the
+# canary host. srcset and imagesrcset hold comma separated candidates, ping
+# and archive hold space separated lists.
+URL_ATTRIBUTES = {
+    "href", "xlink:href", "src", "srcset", "imagesrcset", "action",
+    "formaction", "data", "poster", "cite", "ping", "background", "codebase",
+    "code", "classid", "longdesc", "lowsrc", "dynsrc", "manifest", "profile",
+    "icon", "archive",
+}
+LIST_BY_COMMA = {"srcset", "imagesrcset"}
+LIST_BY_SPACE = {"ping", "archive"}
+
+DANGEROUS_SCHEMES = {"javascript", "vbscript", "data"}
+
+# Schemes whose URL carries an authority after the colon, see split_url.
+SPECIAL_SCHEMES = {"http", "https", "ws", "wss", "ftp", "file"}
+
+# The URL parser strips leading and trailing C0 controls and spaces, and
+# removes every tab, newline and carriage return before it reads the scheme.
+# "  jAvAsCrIpT:" and "java\tscript:" both run in a browser.
+C0_AND_SPACE = "".join(chr(c) for c in range(0x21))
+TAB_NEWLINE = re.compile(r"[\t\n\r]")
+SCHEME = re.compile(r"([a-zA-Z][a-zA-Z0-9+.-]*):")
+AUTHORITY = re.compile(r"[^/\\?#]*")
+
+
+def split_url(value):
+    """Return (scheme, host) for a URL the way a browser reads it.
+
+    The host is lower case, with no user information, port or trailing dot,
+    and it is "" for a relative URL. A backslash counts as a slash, as it
+    does in a browser for the special schemes, so https:\\\\evil.example is
+    not mistaken for a path. A special scheme with no slashes after the colon
+    is read as having an authority too (http:evil.example reaches that host
+    in a browser), which is the safe side of the one case where a browser
+    would treat it as relative.
+    """
+    text = TAB_NEWLINE.sub("", value.strip(C0_AND_SPACE))
+    match = SCHEME.match(text)
+    if match:
+        scheme = match.group(1).lower()
+        rest = text[match.end():]
+    else:
+        scheme = ""
+        rest = text
+    host = ""
+    if scheme in SPECIAL_SCHEMES or (not scheme and len(rest) >= 2
+                                     and rest[0] in "/\\" and rest[1] in "/\\"):
+        authority = AUTHORITY.match(rest.lstrip("/\\")).group(0)
+        host = authority.rsplit("@", 1)[-1]
+        if host.startswith("["):
+            host = host.split("]", 1)[0] + "]"
+        else:
+            host = host.split(":", 1)[0]
+        host = host.lower().rstrip(".")
+    return scheme, host
+
+
+def url_list(attribute, value):
+    """Return the URLs in one attribute value."""
+    if attribute in LIST_BY_COMMA:
+        return [c.split()[0] for c in value.split(",") if c.split()]
+    if attribute in LIST_BY_SPACE:
+        return value.split()
+    return [value]
+
+
+def refresh_url(content):
+    """Return the URL in the content of a meta refresh, or "" for a reload."""
+    match = re.match(r"\s*[\d.]*\s*[;,]?\s*(?:url\s*=\s*)?(.*)$", content, re.I | re.S)
+    url = match.group(1).strip() if match else content.strip()
+    if len(url) >= 2 and url[0] in "\"'" and url[-1] == url[0]:
+        url = url[1:-1]
+    return url
+
+
+# ---------------------------------------------------------------------------
+# Styles
+# ---------------------------------------------------------------------------
+
+# A style attribute is accepted when every declaration is in this table and
+# its value matches the pattern. The table is what the templates and the
+# content emit today: sizes, margins and padding, a text alignment, a font
+# size, a border and the hero background. Nothing in it can move an element
+# over the header, the navigation or the footer, hide one, or load from off
+# this site. Everything else is a finding, so a new property in a template
+# is a decision here and not a silent pass.
+#
+# A length is non-negative, has at most four digits and no viewport unit. A
+# negative margin pulls an element over the content above it, and 100vh
+# covers the viewport. Four digits is the cap the logo shortcode puts on its
+# width and height.
+LENGTH = r"(?:0|\d{1,4}(?:\.\d+)?(?:px|%|em|rem|pt))"
+SIZE = r"(?:auto|min-content|max-content|fit-content|" + LENGTH + r")"
+BOX = LENGTH + r"(?:\s+" + LENGTH + r"){0,3}"
+MARGIN = r"(?:auto|" + LENGTH + r")(?:\s+(?:auto|" + LENGTH + r")){0,3}"
+COLOR = r"(?:#[0-9a-f]{3,8}|[a-z]+)"
+BORDER_TOKEN = r"(?:" + LENGTH + r"|" + COLOR + r")"
+URL = r"url\(\s*([\"']?)([^\"'()\s]+)\1\s*\)"
+SAFE_STYLE = {
+    re.compile(r"^(?:min-|max-)?(?:width|height)$"): re.compile(r"^" + SIZE + r"$", re.I),
+    re.compile(r"^margin(?:-(?:top|right|bottom|left))?$"): re.compile(r"^" + MARGIN + r"$", re.I),
+    re.compile(r"^padding(?:-(?:top|right|bottom|left))?$"): re.compile(r"^" + BOX + r"$", re.I),
+    re.compile(r"^text-align$"): re.compile(r"^(?:left|right|center|justify)$", re.I),
+    re.compile(r"^font-size$"): re.compile(
+        r"^(?:" + LENGTH + r"|xx-small|x-small|small|medium|large|x-large|xx-large|smaller|larger)$", re.I),
+    re.compile(r"^border(?:-(?:top|right|bottom|left))?$"): re.compile(
+        r"^" + BORDER_TOKEN + r"(?:\s+" + BORDER_TOKEN + r"){0,2}$", re.I),
+    re.compile(r"^border-radius$"): re.compile(r"^" + BOX + r"$", re.I),
+    re.compile(r"^background-image$"): re.compile(r"^" + URL + r"$", re.I),
+}
+STYLE_URL = re.compile(URL, re.I)
+
+# A <style> element is template output whose text changes from page to page
+# (the agenda partial writes one grid per event), so neither a hash nor the
+# attribute table above fits it. The block is a finding when it carries a
+# property or a token that positions, layers, hides or loads, or a CSS
+# escape, which has no honest use in a stylesheet this site writes. A
+# negative number is one that follows a colon, a space or a bracket: the
+# agenda classes are named length-1, length-2 and so on.
+STYLE_BLOCK_DENY = re.compile(
+    r"(?<![\w-])(?:position|z-index|inset(?:-[\w-]+)?|top|right|bottom|left|"
+    r"transform(?:-[\w-]+)?|translate|scale|rotate|perspective|opacity|"
+    r"visibility|display|pointer-events|content|clip|clip-path|mask(?:-[\w-]+)?|"
+    r"filter|backdrop-filter|behavior|-moz-binding|float)\s*:"
+    r"|url\s*\(|image-set\s*\(|expression\s*\(|@import|@font-face|@namespace"
+    r"|\\|(?<![\w-])-\d|\d(?:vw|vh|vmin|vmax|svw|svh|lvw|lvh|dvw|dvh)\b",
+    re.I)
+
+
+def check_style_attribute(value):
+    """Return (accepted, urls) for a style attribute value.
+
+    urls holds every url() target, so that the allowlist can be matched
+    against what the style loads and the canary rule can see it.
+    """
+    urls = [m.group(2) for m in STYLE_URL.finditer(value)]
+    for declaration in value.split(";"):
+        if not declaration.strip():
+            continue
+        if ":" not in declaration:
+            return False, urls
+        name, text = declaration.split(":", 1)
+        name, text = name.strip().lower(), text.strip()
+        for property_pattern, value_pattern in SAFE_STYLE.items():
+            if property_pattern.match(name):
+                if not value_pattern.match(text):
+                    return False, urls
+                break
+        else:
+            return False, urls
+    return True, urls
+
+
+# ---------------------------------------------------------------------------
+# Elements
+# ---------------------------------------------------------------------------
+
+HANDLER = re.compile(r"^on[a-z]")
+
+# <script type=...> values that a browser never executes.
+DATA_BLOCK_TYPES = {"application/ld+json", "application/json"}
+
+# <link rel=...> tokens that make the browser fetch the href as code or style.
+LOADING_RELS = {"stylesheet", "preload", "modulepreload", "prefetch", "import"}
+
+# Elements of SVG animation that can rewrite an href while the page is open.
+ANIMATORS = {"set", "animate", "animatemotion", "animatetransform"}
+
+KINDS = [
+    ("handler", "event handler attribute"),
+    ("scheme", "javascript:, vbscript: or data: URL"),
+    ("canary", "URL on the canary host, a template printed a name as markup"),
+    ("script-inline", "inline script"),
+    ("script-external", "script loaded from off this site"),
+    ("iframe", "embedded document"),
+    ("srcdoc", "iframe srcdoc, inline document in the page origin"),
+    ("object", "plugin object"),
+    ("embed", "plugin embed"),
+    ("base", "base element, rewrites every relative URL"),
+    ("form", "form or formaction that posts off this site"),
+    ("refresh", "meta refresh off this site"),
+    ("style-attr", "inline style outside SAFE_STYLE"),
+    ("style-block", "stylesheet that positions, layers, hides or loads"),
+    ("stylesheet", "stylesheet or preload from off this site"),
+    ("svg-animate", "SVG animation that targets an href"),
+]
+KIND_TEXT = dict(KINDS)
+
+
+# ---------------------------------------------------------------------------
+# Known and accepted exceptions
+# ---------------------------------------------------------------------------
+
+# Keys:
+#   path    a page path relative to the build directory, or a directory
+#           prefix ending in "/"
+#   kind    one of KINDS
+#   prefix  the URL the element loads must start with this, scheme, host and
+#           the start of the path, so a look-alike host does not match
+#   sha256  the SHA-256 of the inline text with its whitespace collapsed, for
+#           a script-inline or style-block finding
+#   why     the reason, in words
+#
+# The Hugo alias pages (a meta refresh to the new URL of a moved page) and
+# the eleven redirects in the archived pybcn.org snapshot need no entry: a
+# refresh that stays on this site is not a finding. The archived snapshots
+# are frozen copies under static/archives/, owned by @pybcn/core through the
+# /static/ rule. They stay in the scan, and the two inline scripts they hold
+# are pinned by hash below, so a change to a frozen page still fails here.
+ALLOWLIST = [
+    {"path": "pybcn_association/membership/index.html",
+     "kind": "form",
+     "prefix": "https://www.paypal.com/cgi-bin/webscr",
+     "why": "the PayPal subscription button of the membership-process shortcode"},
+    {"path": "pybcn_association/membership-cancel/index.html",
+     "kind": "form",
+     "prefix": "https://www.paypal.com/cgi-bin/webscr",
+     "why": "the PayPal unsubscribe button of the membership-process shortcode"},
+    {"path": "pybcn_association/propose-a-talk/index.html",
+     "kind": "iframe",
+     "prefix": "https://docs.google.com/forms/",
+     "why": "the talk proposal form, through the google-embed shortcode"},
+    {"path": "pyladies_bcn/call-for-proposals/index.html",
+     "kind": "iframe",
+     "prefix": "https://docs.google.com/forms/",
+     "why": "the PyLadies BCN proposal form, through the google-embed shortcode"},
+    {"path": "events/pyday_bcn/pyday_bcn_2019/index.html",
+     "kind": "iframe",
+     "prefix": "https://calendar.google.com/calendar/embed",
+     "why": "the PyDay 2019 agenda, a Google Calendar through the google-embed shortcode"},
+    {"path": "archives/pybcn.org/",
+     "kind": "script-inline",
+     "sha256": "34a5712b5063c64b5c8e08522ec9ffe70a3bee3b41892ae6ad8039321c58911f",
+     "why": "updateUpcoming(); updatePast(); on the frozen 2016-2019 pages, a call "
+            "into the retired Meetup widget that no longer loads"},
+    {"path": "archives/hacktoberfestbarcelona.com/cdn-cgi/l/email-protection.html",
+     "kind": "script-inline",
+     "sha256": "813813dad35acb4facd8be5f3c127180d341365a81850f7de9639ec22e9b242f",
+     "why": "window._cf_translation = {}; the Cloudflare email protection page "
+            "captured with the frozen snapshot"},
+]
+
+
+def text_hash(text):
+    """SHA-256 of an inline text with runs of whitespace collapsed to one space."""
+    return hashlib.sha256(re.sub(r"\s+", " ", text).strip().encode("utf-8")).hexdigest()
+
+
+def path_matches(entry_path, page):
+    if entry_path.endswith("/"):
+        return page.startswith(entry_path)
+    return page == entry_path
+
+
+def allowed(page, kind, urls, body):
+    """Return the index of the allowlist entry that clears this finding, or None.
+
+    A prefix entry must match every URL the element loads, and the match is
+    on the prefix, so that a hostile URL with the permitted one appended does
+    not pass. A hash entry must match the inline text exactly.
+    """
+    for index, entry in enumerate(ALLOWLIST):
+        if entry["kind"] != kind or not path_matches(entry["path"], page):
+            continue
+        if "prefix" in entry:
+            if urls and all(url.startswith(entry["prefix"]) for url in urls):
+                return index
+        elif "sha256" in entry:
+            if body is not None and text_hash(body) == entry["sha256"]:
+                return index
+    return None
+
+
+# ---------------------------------------------------------------------------
+# The parser
+# ---------------------------------------------------------------------------
+
+class Page(HTMLParser):
+    """Parse one built page and collect findings.
+
+    html.parser reads <script> and <style> as raw text, the way a browser
+    does. A browser does not do that inside <svg> or <math>: there every
+    element's content is markup, and <svg><style><img onerror=...> runs. The
+    parser is told the same, so set_cdata_mode is a no-op while the depth of
+    foreign content is above zero.
+    """
+
+    FOREIGN = {"svg", "math"}
+
+    def __init__(self, page, site_host):
+        super().__init__(convert_charrefs=True)
+        self.page = page
+        self.site_host = site_host
+        self.findings = []
+        self.values = []          # every attribute value and text node, for the canary
+        self.foreign = 0
+        self.collecting = None    # (finding, [text pieces]) of an open script or style
+
+    def set_cdata_mode(self, elem, *args, **kwargs):
+        if self.foreign:
+            return
+        super().set_cdata_mode(elem, *args, **kwargs)
+
+    def on_site(self, url):
+        scheme, host = split_url(url)
+        if scheme in DANGEROUS_SCHEMES:
+            return False
+        if not scheme and not host:
+            return True
+        if scheme in ("http", "https") and self.site_host and host == self.site_host:
+            return True
+        return False
+
+    def record(self, kind, urls=(), body=None, note=None):
+        line, column = self.getpos()
+        text = self.get_starttag_text() or ""
+        text = re.sub(r"\s+", " ", text)
+        if len(text) > 160:
+            text = text[:157] + "..."
+        finding = {
+            "page": self.page, "kind": kind, "line": line, "column": column,
+            "text": text, "urls": list(urls), "body": body, "note": note,
+        }
+        self.findings.append(finding)
+        return finding
+
+    def handle_starttag(self, tag, attrs):
+        attrs = [(name, value if value is not None else "") for name, value in attrs]
+        names = [name for name, _ in attrs]
+        values = dict(reversed(attrs))   # the first of a repeated attribute wins
+        self.values.extend(value for _, value in attrs)
+        if tag in self.FOREIGN:
+            self.foreign += 1
+
+        for name, value in attrs:
+            if HANDLER.match(name):
+                self.record("handler", note=name)
+            if name in URL_ATTRIBUTES:
+                for url in url_list(name, value):
+                    scheme, host = split_url(url)
+                    if scheme in DANGEROUS_SCHEMES:
+                        self.record("scheme", urls=[url], note="%s=%s:" % (name, scheme))
+                    if host == CANARY_HOST:
+                        self.record("canary", urls=[url], note=name)
+
+        if tag == "iframe":
+            if "srcdoc" in names:
+                self.record("srcdoc")
+            self.record("iframe", urls=[values.get("src", "")])
+        elif tag in ("object", "embed", "base"):
+            self.record(tag, urls=[values.get("data" if tag == "object" else "src", "")])
+        elif tag == "script":
+            if "src" in names:
+                if not self.on_site(values["src"]):
+                    self.record("script-external", urls=[values["src"]])
+            elif values.get("type", "").strip().lower() not in DATA_BLOCK_TYPES:
+                self.collecting = (self.record("script-inline", body=""), [])
+        elif tag == "style":
+            self.collecting = (None, [])
+        elif tag == "form":
+            action = values.get("action", "")
+            if action and not self.on_site(action):
+                self.record("form", urls=[action])
+        elif tag in ("button", "input"):
+            action = values.get("formaction", "")
+            if action and not self.on_site(action):
+                self.record("form", urls=[action], note="formaction")
+        elif tag == "meta":
+            if values.get("http-equiv", "").strip().lower() == "refresh":
+                url = refresh_url(values.get("content", ""))
+                if url and not self.on_site(url):
+                    self.record("refresh", urls=[url])
+                if split_url(url)[1] == CANARY_HOST:
+                    self.record("canary", urls=[url], note="refresh")
+        elif tag == "link":
+            rels = set(values.get("rel", "").lower().split())
+            href = values.get("href", "")
+            if rels & LOADING_RELS and href and not self.on_site(href):
+                self.record("stylesheet", urls=[href], note=" ".join(sorted(rels & LOADING_RELS)))
+        elif tag in ANIMATORS:
+            target = values.get("attributename", "").strip().lower()
+            if target in ("href", "xlink:href"):
+                self.record("svg-animate", note=target)
+
+        if "style" in names:
+            accepted, urls = check_style_attribute(values["style"])
+            for url in urls:
+                scheme, host = split_url(url)
+                if scheme in DANGEROUS_SCHEMES:
+                    self.record("scheme", urls=[url], note="style url() %s:" % scheme)
+                if host == CANARY_HOST:
+                    self.record("canary", urls=[url], note="style url()")
+                if accepted and not self.on_site(url):
+                    accepted = False
+            if not accepted:
+                self.record("style-attr", urls=urls)
+
+    def handle_endtag(self, tag):
+        if tag in self.FOREIGN and self.foreign:
+            self.foreign -= 1
+        if self.collecting is not None and tag in ("script", "style"):
+            finding, pieces = self.collecting
+            self.collecting = None
+            body = "".join(pieces)
+            if finding is not None:
+                finding["body"] = body
+            elif STYLE_BLOCK_DENY.search(body):
+                match = STYLE_BLOCK_DENY.search(body)
+                self.record("style-block", body=body, note=match.group(0))
+
+    def handle_data(self, data):
+        self.values.append(data)
+        if self.collecting is not None:
+            self.collecting[1].append(data)
+
+
+# ---------------------------------------------------------------------------
+# The run
+# ---------------------------------------------------------------------------
+
+def site_host_from_config(root):
+    """Return the host of baseURL in config.toml, or ""."""
+    try:
+        text = open(os.path.join(root, "config.toml"), encoding="utf-8").read()
+    except OSError:
+        return ""
+    match = re.search(r'^\s*baseURL\s*=\s*"([^"]*)"', text, re.M)
+    if not match:
+        return ""
+    return split_url(match.group(1))[1]
+
+
+def scan(build, site_host):
+    """Return (pages, findings, suppressed, errors, canary_values)."""
+    pages = []
+    for base, dirs, names in os.walk(build):
+        dirs.sort()
+        for name in sorted(names):
+            if name.lower().endswith((".html", ".htm")):
+                pages.append(os.path.join(base, name))
+    pages.sort()
+
+    findings, suppressed, errors = [], [], []
+    canary_values = None
+    for path in pages:
+        page = os.path.relpath(path, build).replace(os.sep, "/")
+        try:
+            text = open(path, encoding="utf-8").read()
+        except (OSError, UnicodeDecodeError) as error:
+            errors.append("cannot read %s: %s" % (page, error))
+            continue
+        parser = Page(page, site_host)
+        parser.feed(text)
+        parser.close()
+        if page == CANARY_PAGE:
+            canary_values = parser.values
+        for finding in parser.findings:
+            index = allowed(page, finding["kind"], finding["urls"], finding["body"])
+            if index is None:
+                findings.append(finding)
+            else:
+                finding["entry"] = index
+                suppressed.append(finding)
+    return pages, findings, suppressed, errors, canary_values
+
+
+def location(finding):
+    return "%s:%d:%d" % (finding["page"], finding["line"], finding["column"] + 1)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("build", nargs="?", default=None,
+                        help="the directory Hugo built into. Default: public")
+    parser.add_argument("--root", default=None,
+                        help="repository root. Default: the parent of this script")
+    parser.add_argument("--host", default=None,
+                        help="the host of this site. Default: the host of baseURL in config.toml")
+    parser.add_argument("--without-canary", action="store_true",
+                        help="scan a build made without -D, which has no canary page")
+    args = parser.parse_args()
+
+    root = args.root or os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    build = args.build or os.path.join(root, "public")
+    site_host = args.host if args.host is not None else site_host_from_config(root)
+    site_host = site_host.lower().rstrip(".")
+
+    if not os.path.isdir(build):
+        print("check-rendered: %s is not a directory. Build first: "
+              "bin/hugo --minify -D -d public" % build)
+        return 2
+
+    pages, findings, suppressed, errors, canary_values = scan(build, site_host)
+    if not pages:
+        print("check-rendered: no HTML under %s. Build first: "
+              "bin/hugo --minify -D -d public" % build)
+        return 2
+
+    print("check-rendered: scanned %d pages under %s, site host %s"
+          % (len(pages), os.path.relpath(build, root), site_host or "(none)"))
+    print("  kinds: %s" % ", ".join(kind for kind, _ in KINDS))
+
+    if suppressed:
+        print("\nAllowed by the allowlist (%d):" % len(suppressed))
+        for finding in suppressed:
+            print("  %s  %s" % (location(finding), finding["kind"]))
+            print("      reason: %s" % ALLOWLIST[finding["entry"]]["why"])
+
+    # An allowlist entry that matches nothing is an exception that outlived
+    # its cause. Report it so that it gets deleted.
+    used = {finding["entry"] for finding in suppressed}
+    stale = [entry for index, entry in enumerate(ALLOWLIST) if index not in used]
+    if stale:
+        print("\nStale allowlist entries (%d). The markup they cover is gone, "
+              "remove them:" % len(stale))
+        for entry in stale:
+            print("  %s  %s  %s" % (entry["path"], entry["kind"], entry["why"]))
+
+    failed = False
+
+    if findings:
+        failed = True
+        print("\nFAIL  %d finding(s) not allowed:" % len(findings))
+        for finding in findings:
+            print("\n  %s" % location(finding))
+            print("      kind:  %s (%s)" % (finding["kind"], KIND_TEXT[finding["kind"]]))
+            if finding["note"]:
+                print("      on:    %s" % finding["note"])
+            print("      text:  %s" % finding["text"])
+            if finding["kind"] in ("script-inline", "style-block") and finding["body"]:
+                print("      body:  %s" % re.sub(r"\s+", " ", finding["body"]).strip()[:160])
+                print("      sha256: %s" % text_hash(finding["body"]))
+        print("\nThe built page carries markup this site must not serve. Find the "
+              "template, shortcode or content that printed it. If it is wanted, "
+              "add an allowlist entry in bin/check-rendered with a reason.")
+
+    if errors:
+        failed = True
+        print("\nFAIL  %d page(s) could not be read:" % len(errors))
+        for error in errors:
+            print("  %s" % error)
+
+    if args.without_canary:
+        print("\nNOTE  --without-canary: the canary fixture was not checked.")
+    elif canary_values is None:
+        failed = True
+        print("\nFAIL  the canary page %s was not built. Build with -D "
+              "(bin/hugo --minify -D -d public), or pass --without-canary for a "
+              "build that has no drafts." % CANARY_PAGE)
+    else:
+        missing = [who for who, name in CANARY_NAMES.items()
+                   if not any(name in value for value in canary_values)]
+        if missing:
+            failed = True
+            print("\nFAIL  the canary page %s did not render the %s name as text. "
+                  "The fixture in content/ or the grid that lists it has changed."
+                  % (CANARY_PAGE, " or the ".join(missing)))
+        else:
+            print("\nCanary: both names reached %s as text, not as markup." % CANARY_PAGE)
+
+    if failed:
+        return 1
+
+    print("\nPASS  no dangerous markup outside the allowlist.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 1e165aff2dcf80b9227ed8b0a7f58dc0ee7d3362 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:30:30 +0200
Subject: [PATCH 02/16] Keep archives/ in the check-rendered scan and say why

The allowlist was written against a prototype. Measured against the real
build of 317 pages it clears 49 findings, all of them pre-existing, and no
entry is stale. The 11 alias pages that Hugo generates and the 11 redirects
in the archived pybcn.org snapshot are refreshes that stay on this site, so
they are matched by that shape and need no entry.

The comment now records what the 56 archived pages hold, so that the choice
to scan them rather than exclude the directory can be checked later: 100
same-site scripts, 44 inline scripts with two distinct bodies, 67 style
attributes that are all sizes and margins, two forms with no action and one
body-margin stylesheet. Two hash entries cover all of it.
---
 bin/check-rendered | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/bin/check-rendered b/bin/check-rendered
index 6002ad51..612ea1fa 100755
--- a/bin/check-rendered
+++ b/bin/check-rendered
@@ -303,10 +303,20 @@ KIND_TEXT = dict(KINDS)
 #
 # The Hugo alias pages (a meta refresh to the new URL of a moved page) and
 # the eleven redirects in the archived pybcn.org snapshot need no entry: a
-# refresh that stays on this site is not a finding. The archived snapshots
-# are frozen copies under static/archives/, owned by @pybcn/core through the
-# /static/ rule. They stay in the scan, and the two inline scripts they hold
-# are pinned by hash below, so a change to a frozen page still fails here.
+# refresh that stays on this site is not a finding, whatever page it is on.
+# Hugo writes the alias pages at build time, so they are matched by that
+# shape and never by path.
+#
+# archives/ stays in the scan. The 56 pages there are frozen copies under
+# static/archives/, served as they are, and a change to them needs a review
+# from @pybcn/core through the /static/ rule. Excluding the directory would
+# make the check blind to 56 served pages, and the price of keeping them is
+# two entries. Measured on the 2026-10 build: the archives hold 100 script
+# elements that all load from this site, 44 inline scripts with two distinct
+# bodies (the two entries below), 67 style attributes that are all sizes and
+# margins, two forms with no action and one <style> that resets the body
+# margin. Pinning the two bodies by hash means that an edit to a frozen page,
+# or a new snapshot with a script in it, fails here and gets a decision.
 ALLOWLIST = [
     {"path": "pybcn_association/membership/index.html",
      "kind": "form",

From aeb2f23f60e4ae1b96e5054c0d7c0e9c1b82dad3 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:34:57 +0200
Subject: [PATCH 03/16] Add the canary fixture that check-rendered reads

One sponsor and one person whose name is harmless as text and unmistakable
as markup: it closes the attribute it sits in and opens a link to
canary.invalid. content/canary.md lists both through the real sponsor and
people grids, so the names take the same path as every other name on the
site. If a template ever prints one of them as markup, the page carries a
link to canary.invalid and bin/check-rendered fails on it.

All three files are drafts. Hugo builds them only with -D, which the pull
request workflow passes and the deploy workflow does not, so the deployed
site never carries them: a build without -D has no trace of the word. The
check fails when the canary page is missing or when either name did not
reach it as text, so the fixture cannot disappear silently.

The sponsor has its own small SVG logo, so the name goes through the alt
attribute, the path of the defect this check was written for, and no real
sponsor's file is borrowed. bin/check-content stays at 0 errors and the same
warnings as before, and bin/check-html-safety passes: the name holds no
pattern that check looks for, which is the point.
---
 content/canary.md                             | 23 +++++++++++++++++++
 content/people/canary.md                      | 12 ++++++++++
 content/sponsors/canary.md                    | 11 +++++++++
 .../assets/images/sponsors/canary.svg         |  1 +
 4 files changed, 47 insertions(+)
 create mode 100644 content/canary.md
 create mode 100644 content/people/canary.md
 create mode 100644 content/sponsors/canary.md
 create mode 100644 themes/pybcn_theme/assets/images/sponsors/canary.svg

diff --git a/content/canary.md b/content/canary.md
new file mode 100644
index 00000000..30baaf71
--- /dev/null
+++ b/content/canary.md
@@ -0,0 +1,23 @@
+---
+title: Canary
+description: "Fixture page for bin/check-rendered"
+layout: event
+draft: true
+sponsor_levels:
+  - sponsors_per_line: 4
+    sponsors:
+      - canary
+people_sections:
+  - title: Canary
+    id: canary_people
+    levels:
+      - people_per_line: 4
+        people:
+          - canary
+---
+
+This page renders the canary sponsor and the canary person through the real
+sponsor and people grids, so that `bin/check-rendered` can confirm on every
+build that both names reach the page as text and not as markup. All three
+files are drafts: Hugo builds them only with `-D`, which the pull request
+workflow passes and the deploy workflow does not, so no visitor sees them.
diff --git a/content/people/canary.md b/content/people/canary.md
new file mode 100644
index 00000000..135dac4e
--- /dev/null
+++ b/content/people/canary.md
@@ -0,0 +1,12 @@
+---
+id: canary
+name: 'Canary person "><a href="https://canary.invalid/person">canary</a><span x="'
+short_bio: "Fixture for bin/check-rendered"
+pybcn_position: "Canary"
+draft: true
+---
+
+Fixture for `bin/check-rendered`, not a person. The name is harmless as text
+and unmistakable as markup. It must reach the page as text; if a template
+prints it as markup, the page carries a link to canary.invalid and the check
+fails. A draft is built only with `-D`, so the deployed site never has it.
diff --git a/content/sponsors/canary.md b/content/sponsors/canary.md
new file mode 100644
index 00000000..2dffb5ed
--- /dev/null
+++ b/content/sponsors/canary.md
@@ -0,0 +1,11 @@
+---
+id: canary
+name: 'Canary sponsor "><a href="https://canary.invalid/sponsor">canary</a><span x="'
+logo_image: canary.svg
+draft: true
+---
+
+Fixture for `bin/check-rendered`, not a sponsor. The name is harmless as text
+and unmistakable as markup. It must reach the page as text; if a template
+prints it as markup, the page carries a link to canary.invalid and the check
+fails. A draft is built only with `-D`, so the deployed site never has it.
diff --git a/themes/pybcn_theme/assets/images/sponsors/canary.svg b/themes/pybcn_theme/assets/images/sponsors/canary.svg
new file mode 100644
index 00000000..ae953337
--- /dev/null
+++ b/themes/pybcn_theme/assets/images/sponsors/canary.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 160 40" width="160" height="40" role="img" aria-label="canary"><rect width="160" height="40" rx="4" fill="#eeeeee"/><text x="80" y="26" text-anchor="middle" font-family="sans-serif" font-size="16" fill="#555555">canary</text></svg>

From 39dc6c8a87c2c4ef457078024a63a4e709ce20cc Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:41:43 +0200
Subject: [PATCH 04/16] Close the holes a self-attack on check-rendered found

A suite of 114 hostile pages, one vector each, was run against the check.
29 got through. The groups, and what changed for each:

Off-site loads. An <img>, a srcset candidate, a <video> poster, an <input
type=image>, an SVG <image> or an <a ping> that points off this site runs
nothing, but it tells a third party who viewed the page. They are now a
"load" finding. The real build has seven: the PayPal button image and the
1x1 pixel PayPal ships inside its snippet, on the two membership pages, and
the Eventbrite button of PyDay 2018 on the live page and on its two frozen
copies. Each is an allowlist entry with the reason written out.

<style> blocks. The deny list missed overflow:hidden, a negative length
written -.5em or inside calc(), offset-path, zoom, all:unset, a transparent
colour, font-size:0 and a rule wrapped in @media. The block now gets the
same treatment as the style attribute: every declaration must name a
property in SAFE_BLOCK_STYLE, the attribute table plus the grid properties
the agenda writes, and match its value pattern. An at-rule, a url(), a CSS
escape, a comment, a negative number or a viewport unit refuse the whole
block. The agenda blocks on eight event pages and the body reset in the
archive still pass.

Style attributes. A backslash (a CSS escape spells j\61vascript:), a
comment and any character outside printable ASCII now fail the attribute.

Parser traps. html.parser reads <!-->, <!---> and --!> as comment text
where a browser closes the comment, and <![CDATA[ outside svg or math as a
marked section where a browser sees a comment up to the first >. Each would
hide a <script> from the check. They are now a "parser-trap" finding, raised
from the parser callbacks so that the CDATA marker inside an old <script>
is not one. hugo --minify strips every comment, so only a static file can
carry them; none does today.

Embedders and link rels. <frame>, <portal>, <fencedframe> and <applet> join
<iframe>, <object> and <embed>. A <link> with rel icon, apple-touch-icon,
mask-icon, manifest, preconnect or dns-prefetch that points off this site is
a finding, as a stylesheet already was. <base> is read from href, which the
previous code got wrong.

All 114 vectors now behave as expected, 4 of them as documented residuals:
a hidden attribute, <dialog open>, a custom protocol handler and a plain
off-site link are out of scope. The real build still passes with 56
findings cleared by the allowlist and none stale.
---
 bin/check-rendered | 235 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 198 insertions(+), 37 deletions(-)

diff --git a/bin/check-rendered b/bin/check-rendered
index 612ea1fa..a00e00cc 100755
--- a/bin/check-rendered
+++ b/bin/check-rendered
@@ -23,16 +23,23 @@ reports:
     the rest of URL_ATTRIBUTES), in a meta refresh, and in a url() of an
     inline style
   - a <script> that is inline, or whose src is not on this site
-  - <iframe>, <object>, <embed>, <base>, an iframe srcdoc, and a <form> or a
-    formaction that posts off this site
+  - <iframe>, <frame>, <portal>, <object>, <embed>, <applet>, <base>, an
+    iframe srcdoc, and a <form> or a formaction that posts off this site
   - a <meta http-equiv="refresh"> that sends the visitor off this site
   - a style attribute that does more than size, space, align or decorate the
     element, see SAFE_STYLE. position, z-index, transform, a negative margin
     or a viewport unit build a page overlay with no script at all
-  - a <style> element that positions, layers, hides or loads, see
-    STYLE_BLOCK_DENY
-  - a <link> that loads a stylesheet or a preload from off this site
+  - a <style> element with a property or a value outside SAFE_BLOCK_STYLE,
+    the grid and box properties the templates write. An at-rule, a url(), a
+    CSS escape, a negative length or a viewport unit never pass
+  - a <link> that fetches from off this site: a stylesheet, a preload, an
+    icon, a manifest or a preconnect, see LOADING_RELS
+  - an image, a media file or a click beacon (ping) fetched from off this
+    site. It runs nothing, but it tells a third party who viewed the page
   - an SVG <set> or <animate> that targets an href
+  - a comment or a marked section that a browser reads differently from
+    html.parser, which could hide a <script> from this check, see "Parser
+    traps" below
   - any URL on CANARY_HOST, see "The canary" below
 
 Why a parser and not grep. The site builds with --minify, which unquotes
@@ -44,6 +51,15 @@ parser decodes the way the browser does, and it cannot tell a <style> that
 is inside an <svg> from one that is not. The parser runs the same rules on
 a minified and on a plain build and gives the same result.
 
+Parser traps. html.parser and a browser disagree on three pieces of markup,
+and each one would let a <script> through: <!--> and <!---> close a comment
+at once in a browser, but the parser reads on to the next -->; a comment
+ends at --!> in a browser and not in the parser; and <![CDATA[ outside
+<svg> and <math> is a comment that ends at the first > in a browser, but a
+marked section that ends at ]]> in the parser. Each one is reported as a
+finding, so the disagreement is never silent. hugo --minify strips every
+comment, so a built page has none of them unless a static file carries it.
+
 "On this site" means a URL with no host, or a host equal to the one in
 baseURL in config.toml (--host overrides it). The build made by the links
 job uses --baseURL /, so every internal URL there has no host and passes
@@ -201,31 +217,77 @@ SAFE_STYLE = {
     re.compile(r"^margin(?:-(?:top|right|bottom|left))?$"): re.compile(r"^" + MARGIN + r"$", re.I),
     re.compile(r"^padding(?:-(?:top|right|bottom|left))?$"): re.compile(r"^" + BOX + r"$", re.I),
     re.compile(r"^text-align$"): re.compile(r"^(?:left|right|center|justify)$", re.I),
+    # A font size of zero hides the text, so zero is refused here and nowhere else.
     re.compile(r"^font-size$"): re.compile(
-        r"^(?:" + LENGTH + r"|xx-small|x-small|small|medium|large|x-large|xx-large|smaller|larger)$", re.I),
+        r"^(?!0+(?:\.0+)?(?:px|%|em|rem|pt)?$)"
+        r"(?:" + LENGTH + r"|xx-small|x-small|small|medium|large|x-large|xx-large|smaller|larger)$", re.I),
     re.compile(r"^border(?:-(?:top|right|bottom|left))?$"): re.compile(
         r"^" + BORDER_TOKEN + r"(?:\s+" + BORDER_TOKEN + r"){0,2}$", re.I),
     re.compile(r"^border-radius$"): re.compile(r"^" + BOX + r"$", re.I),
     re.compile(r"^background-image$"): re.compile(r"^" + URL + r"$", re.I),
 }
 STYLE_URL = re.compile(URL, re.I)
+STYLE_CHARS = re.compile(r"[\x20-\x7e\t\n\r]*")
 
 # A <style> element is template output whose text changes from page to page
-# (the agenda partial writes one grid per event), so neither a hash nor the
-# attribute table above fits it. The block is a finding when it carries a
-# property or a token that positions, layers, hides or loads, or a CSS
-# escape, which has no honest use in a stylesheet this site writes. A
-# negative number is one that follows a colon, a space or a bracket: the
-# agenda classes are named length-1, length-2 and so on.
-STYLE_BLOCK_DENY = re.compile(
-    r"(?<![\w-])(?:position|z-index|inset(?:-[\w-]+)?|top|right|bottom|left|"
-    r"transform(?:-[\w-]+)?|translate|scale|rotate|perspective|opacity|"
-    r"visibility|display|pointer-events|content|clip|clip-path|mask(?:-[\w-]+)?|"
-    r"filter|backdrop-filter|behavior|-moz-binding|float)\s*:"
-    r"|url\s*\(|image-set\s*\(|expression\s*\(|@import|@font-face|@namespace"
-    r"|\\|(?<![\w-])-\d|\d(?:vw|vh|vmin|vmax|svw|svh|lvw|lvh|dvw|dvh)\b",
+# (the agenda partial writes one grid per event), so a hash does not fit it.
+# It gets the same treatment as the attribute: every declaration must name a
+# property in SAFE_BLOCK_STYLE and match its value pattern. The table is the
+# attribute table plus the grid properties the agenda writes. A deny list was
+# tried first and missed eight ways to hide or move an element (overflow,
+# zoom, offset-path, all, a negative length written -.5em or inside calc(),
+# a zero font-size, a transparent colour, a rule inside @media), so the block
+# is now accepted only for what it is known to need.
+#
+# Before the grammar runs, the whole block is refused when it holds an
+# at-rule, a url(), an image-set(), an expression(), a CSS escape, a comment,
+# a negative number or a viewport unit. A negative number is one that
+# follows a colon, a space or a bracket: the agenda classes are named
+# length-1, length-2 and so on.
+BLOCK_REFUSE = re.compile(
+    r"@|\\|/\*|url\s*\(|image-set\s*\(|expression\s*\(|(?<![\w-])-\s*\.?\d"
+    r"|\d(?:vw|vh|vmin|vmax|svw|svh|lvw|lvh|dvw|dvh)\b",
     re.I)
+GRID_VALUE = re.compile(r"^[\w\s,./()\"'%-]+$")
+SAFE_BLOCK_STYLE = dict(SAFE_STYLE)
+SAFE_BLOCK_STYLE[re.compile(
+    r"^(?:grid-(?:template-(?:columns|rows|areas)|(?:column|row)(?:-(?:start|end))?|area)"
+    r"|(?:grid-)?(?:row-|column-)?gap)$")] = GRID_VALUE
+RULE = re.compile(r"\s*([^{}]*?)\s*\{([^{}]*)\}")
+
 
+def check_style_block(text):
+    """Return (accepted, note) for the text of a <style> element.
+
+    note names the token, the property or the declaration that failed, for
+    the report.
+    """
+    match = BLOCK_REFUSE.search(text)
+    if match:
+        return False, match.group(0)
+    position = 0
+    for rule in RULE.finditer(text):
+        if text[position:rule.start()].strip():
+            return False, "text outside a rule"
+        position = rule.end()
+        for declaration in rule.group(2).split(";"):
+            if not declaration.strip():
+                continue
+            if ":" not in declaration:
+                return False, declaration.strip()
+            name, value = declaration.split(":", 1)
+            name = name.strip().lower()
+            value = re.sub(r"\s*!important\s*$", "", value.strip(), flags=re.I)
+            for property_pattern, value_pattern in SAFE_BLOCK_STYLE.items():
+                if property_pattern.match(name):
+                    if not value_pattern.match(value):
+                        return False, "%s: %s" % (name, value)
+                    break
+            else:
+                return False, name
+    if text[position:].strip():
+        return False, "text outside a rule"
+    return True, None
 
 def check_style_attribute(value):
     """Return (accepted, urls) for a style attribute value.
@@ -234,6 +296,12 @@ def check_style_attribute(value):
     against what the style loads and the canary rule can see it.
     """
     urls = [m.group(2) for m in STYLE_URL.finditer(value)]
+    # A backslash is a CSS escape, which spells j\61vascript: or hides a
+    # slash in a URL from the patterns below. A comment has no honest use in
+    # a one-line attribute. A character outside printable ASCII is not a
+    # property or a length the templates write.
+    if "\\" in value or "/*" in value or not STYLE_CHARS.fullmatch(value):
+        return False, urls
     for declaration in value.split(";"):
         if not declaration.strip():
             continue
@@ -260,8 +328,41 @@ HANDLER = re.compile(r"^on[a-z]")
 # <script type=...> values that a browser never executes.
 DATA_BLOCK_TYPES = {"application/ld+json", "application/json"}
 
-# <link rel=...> tokens that make the browser fetch the href as code or style.
-LOADING_RELS = {"stylesheet", "preload", "modulepreload", "prefetch", "import"}
+# <link rel=...> tokens that make the browser fetch the href, or open a
+# connection to its host, as soon as the page loads.
+LOADING_RELS = {
+    "stylesheet", "preload", "modulepreload", "prefetch", "prerender", "import",
+    "icon", "apple-touch-icon", "apple-touch-icon-precomposed", "mask-icon",
+    "manifest", "preconnect", "dns-prefetch",
+}
+
+# Elements that fetch a resource when the page loads, and the attributes they
+# fetch it from. An off-site URL in one of them is a "load" finding: it runs
+# nothing, but the third party learns the address of every visitor. An
+# <input> counts only when its type is image. <image> is the SVG element.
+LOADERS = {
+    "img": ("src", "srcset"),
+    "source": ("src", "srcset"),
+    "video": ("src", "poster"),
+    "audio": ("src",),
+    "track": ("src",),
+    "input": ("src",),
+    "image": ("href", "xlink:href"),
+}
+
+# Elements that embed another document or a plugin, with the kind they are
+# reported as and the attribute that names what they embed. Each one is a
+# finding whatever it embeds.
+EMBEDDERS = {
+    "iframe": ("iframe", "src"),
+    "frame": ("iframe", "src"),
+    "portal": ("iframe", "src"),
+    "fencedframe": ("iframe", "src"),
+    "object": ("object", "data"),
+    "embed": ("embed", "src"),
+    "applet": ("object", "codebase"),
+    "base": ("base", "href"),
+}
 
 # Elements of SVG animation that can rewrite an href while the page is open.
 ANIMATORS = {"set", "animate", "animatemotion", "animatetransform"}
@@ -272,17 +373,19 @@ KINDS = [
     ("canary", "URL on the canary host, a template printed a name as markup"),
     ("script-inline", "inline script"),
     ("script-external", "script loaded from off this site"),
-    ("iframe", "embedded document"),
+    ("iframe", "embedded document: iframe, frame or portal"),
     ("srcdoc", "iframe srcdoc, inline document in the page origin"),
-    ("object", "plugin object"),
+    ("object", "plugin object or applet"),
     ("embed", "plugin embed"),
     ("base", "base element, rewrites every relative URL"),
     ("form", "form or formaction that posts off this site"),
     ("refresh", "meta refresh off this site"),
     ("style-attr", "inline style outside SAFE_STYLE"),
-    ("style-block", "stylesheet that positions, layers, hides or loads"),
-    ("stylesheet", "stylesheet or preload from off this site"),
+    ("style-block", "stylesheet with a property or a value outside SAFE_BLOCK_STYLE"),
+    ("link", "link element that fetches from off this site"),
+    ("load", "image, media or click beacon fetched from off this site"),
     ("svg-animate", "SVG animation that targets an href"),
+    ("parser-trap", "comment or marked section a browser reads differently, can hide a script"),
 ]
 KIND_TEXT = dict(KINDS)
 
@@ -348,6 +451,33 @@ ALLOWLIST = [
      "sha256": "813813dad35acb4facd8be5f3c127180d341365a81850f7de9639ec22e9b242f",
      "why": "window._cf_translation = {}; the Cloudflare email protection page "
             "captured with the frozen snapshot"},
+    {"path": "pybcn_association/membership/index.html",
+     "kind": "load",
+     "prefix": "https://www.paypalobjects.com/en_US/GB/i/btn/btn_subscribeCC_LG.gif",
+     "why": "the PayPal button image of the membership-process shortcode"},
+    {"path": "pybcn_association/membership/index.html",
+     "kind": "load",
+     "prefix": "https://www.paypalobjects.com/es_ES/i/scr/pixel.gif",
+     "why": "the 1x1 pixel PayPal ships inside its button snippet. It tells PayPal "
+            "who viewed the page and the button works without it; dropping it from "
+            "the shortcode is a decision for @pybcn/core"},
+    {"path": "pybcn_association/membership-cancel/index.html",
+     "kind": "load",
+     "prefix": "https://www.paypalobjects.com/en_US/GB/i/btn/btn_subscribeCC_LG.gif",
+     "why": "the PayPal button image of the membership-process shortcode"},
+    {"path": "pybcn_association/membership-cancel/index.html",
+     "kind": "load",
+     "prefix": "https://www.paypalobjects.com/es_ES/i/scr/pixel.gif",
+     "why": "the same PayPal pixel, on the unsubscribe page"},
+    {"path": "events/pyday_bcn/pyday_bcn_2018/index.html",
+     "kind": "load",
+     "prefix": "https://www.eventbrite.es/custombutton?eid=50585714233",
+     "why": "the Eventbrite registration button of PyDay 2018, an image Eventbrite "
+            "serves on every visit. The event is over; a local copy would end the entry"},
+    {"path": "archives/pybcn.org/",
+     "kind": "load",
+     "prefix": "https://www.eventbrite.es/custombutton?eid=50585714233",
+     "why": "the same Eventbrite button on the two frozen copies of the 2018 page"},
 ]
 
 
@@ -421,9 +551,10 @@ class Page(HTMLParser):
             return True
         return False
 
-    def record(self, kind, urls=(), body=None, note=None):
+    def record(self, kind, urls=(), body=None, note=None, text=None):
         line, column = self.getpos()
-        text = self.get_starttag_text() or ""
+        if text is None:
+            text = self.get_starttag_text() or ""
         text = re.sub(r"\s+", " ", text)
         if len(text) > 160:
             text = text[:157] + "..."
@@ -453,12 +584,11 @@ class Page(HTMLParser):
                     if host == CANARY_HOST:
                         self.record("canary", urls=[url], note=name)
 
-        if tag == "iframe":
-            if "srcdoc" in names:
+        if tag in EMBEDDERS:
+            kind, attribute = EMBEDDERS[tag]
+            if tag == "iframe" and "srcdoc" in names:
                 self.record("srcdoc")
-            self.record("iframe", urls=[values.get("src", "")])
-        elif tag in ("object", "embed", "base"):
-            self.record(tag, urls=[values.get("data" if tag == "object" else "src", "")])
+            self.record(kind, urls=[values.get(attribute, "")], note=tag)
         elif tag == "script":
             if "src" in names:
                 if not self.on_site(values["src"]):
@@ -486,12 +616,25 @@ class Page(HTMLParser):
             rels = set(values.get("rel", "").lower().split())
             href = values.get("href", "")
             if rels & LOADING_RELS and href and not self.on_site(href):
-                self.record("stylesheet", urls=[href], note=" ".join(sorted(rels & LOADING_RELS)))
+                self.record("link", urls=[href], note=" ".join(sorted(rels & LOADING_RELS)))
         elif tag in ANIMATORS:
             target = values.get("attributename", "").strip().lower()
             if target in ("href", "xlink:href"):
                 self.record("svg-animate", note=target)
 
+        if tag in LOADERS and (tag != "input" or values.get("type", "").strip().lower() == "image"):
+            urls = []
+            for attribute in LOADERS[tag]:
+                if attribute in values:
+                    urls.extend(url_list(attribute, values[attribute]))
+            off_site = [url for url in urls
+                        if url and split_url(url)[0] not in DANGEROUS_SCHEMES
+                        and not self.on_site(url)]
+            if off_site:
+                self.record("load", urls=off_site)
+        if values.get("ping", "").strip():
+            self.record("load", urls=url_list("ping", values["ping"]), note="ping")
+
         if "style" in names:
             accepted, urls = check_style_attribute(values["style"])
             for url in urls:
@@ -514,15 +657,33 @@ class Page(HTMLParser):
             body = "".join(pieces)
             if finding is not None:
                 finding["body"] = body
-            elif STYLE_BLOCK_DENY.search(body):
-                match = STYLE_BLOCK_DENY.search(body)
-                self.record("style-block", body=body, note=match.group(0))
+            else:
+                accepted, note = check_style_block(body)
+                if not accepted:
+                    self.record("style-block", body=body, note=note)
 
     def handle_data(self, data):
         self.values.append(data)
         if self.collecting is not None:
             self.collecting[1].append(data)
 
+    # The parser traps, see the module docstring. The parser calls neither
+    # method for the text of a <script> or a <style>, so the "<![CDATA[" that
+    # old scripts open with is not reported. Inside <svg> and <math> a CDATA
+    # section is text in a browser too, so it is not reported either.
+    def handle_comment(self, data):
+        if data.startswith(">") or data.startswith("->"):
+            self.record("parser-trap", body=data, text="<!--" + data[:80],
+                        note="a browser closes this comment at <!--> or <!--->")
+        elif "--!>" in data:
+            self.record("parser-trap", body=data, text="<!--" + data[:80],
+                        note="a browser closes this comment at --!>")
+
+    def unknown_decl(self, data):
+        if not self.foreign:
+            self.record("parser-trap", body=data, text="<![" + data[:80],
+                        note="a browser reads <![ outside svg or math as a comment up to the first >")
+
 
 # ---------------------------------------------------------------------------
 # The run
@@ -638,7 +799,7 @@ def main():
             if finding["note"]:
                 print("      on:    %s" % finding["note"])
             print("      text:  %s" % finding["text"])
-            if finding["kind"] in ("script-inline", "style-block") and finding["body"]:
+            if finding["kind"] in ("script-inline", "style-block", "parser-trap") and finding["body"]:
                 print("      body:  %s" % re.sub(r"\s+", " ", finding["body"]).strip()[:160])
                 print("      sha256: %s" % text_hash(finding["body"]))
         print("\nThe built page carries markup this site must not serve. Find the "

From 081891885d0ff9d8fdef09e3030fa5256146a63a Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:43:53 +0200
Subject: [PATCH 05/16] ci: run check-rendered on the build the links job makes

The links job already builds the site with --minify into public/, which is
what bin/check-rendered reads, so the check runs there and the workflow
still builds twice, not three times. The build gains -D: the canary fixture
is three draft pages and the check fails without them. The deploy workflow
keeps building without -D, so the fixture never reaches the live site.

The check is standard library only, so the runner's python3 runs it with no
new action to pin. lychee gets one more exclusion: the fixture names
canary.invalid as text, lychee reads URLs out of text nodes, and the host
never resolves.
---
 .github/workflows/pr.yml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index fadd92b9..1200064d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -64,7 +64,16 @@ jobs:
       - name: Build
         # A root-relative baseURL turns every internal link into "/path/", so
         # lychee resolves it inside this build and not on the live site.
-        run: hugo --minify -d public --baseURL /
+        # -D builds the drafts: the canary fixture that bin/check-rendered
+        # reads is three draft pages. The deploy workflow builds without -D,
+        # so the fixture never reaches the live site.
+        run: hugo --minify -D -d public --baseURL /
+
+      - name: Check the built pages for dangerous markup
+        # Reads what Hugo wrote, so a template defect is caught here even
+        # when every content file is clean. Standard library only: the
+        # runner's python3 is enough.
+        run: bin/check-rendered public
 
       - name: Check links
         uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
@@ -73,7 +82,10 @@ jobs:
           #   every absolute link in a local file as an error.
           # --exclude-path: the frozen 2016-2019 snapshots under archives/
           #   keep their dead links on purpose.
-          # --exclude: hosts that answer bots with 400, 403, or 999.
+          # --exclude: hosts that answer bots with 400, 403, or 999, and
+          #   canary.invalid, the host the canary fixture names as text.
+          #   lychee reads URLs out of text nodes too, and .invalid never
+          #   resolves.
           args: >-
             --no-progress
             --exclude-all-private
@@ -84,6 +96,7 @@ jobs:
             --exclude '^https?://(www\.)?x\.com/'
             --exclude 'linkedin\.com'
               --exclude 'pybcn\.slack\.com'
+            --exclude 'canary\.invalid'
             'public/**/*.html'
           # External sites rate-limit. Keep the report in the job summary and
           # do not turn the check red.

From 3b3af5e2bc881d4e7c4a4bcf917fd56aa54e711b Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:43:54 +0200
Subject: [PATCH 06/16] ci: cache the generated images between builds

Every build on a pull request started cold and resized more than 400
images, about 90 seconds of CPU per job for output that is the same every
time. resources/_gen is now restored with actions/cache, in the two building
jobs of pr-checks and in the deploy job. The deploy runs on edition, the base
of every pull request, and a pull request can restore a cache saved on its
base branch, so the cache the deploy saves is the one a new pull request
starts from.

The key is a hash of the image sources with a restore prefix. Hugo names each
generated file after a hash of the source and the processing options, so a
restored file is used only when both match, and an entry left from a removed
or changed image is never served, only ignored. actions/cache is pinned to
the commit of v6.1.0, as every other action in these files is.
---
 .github/workflows/gh-pages.yml | 17 +++++++++++++++++
 .github/workflows/pr.yml       | 30 ++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index e6984135..e2f61ad0 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -19,6 +19,23 @@ jobs:
       - name: Read the Hugo version
         run: echo "HUGO_VERSION=$(tr -d '[:space:]' < .hugo-version)" >> "$GITHUB_ENV"
 
+      - name: Restore the generated images
+        # A cold build resizes more than 400 images, about 90 seconds of CPU
+        # for output that is the same every time. Hugo names each generated
+        # file after a hash of the source image and the processing options,
+        # so a cached file is used only when both match and a stale entry is
+        # never served. The key follows the image sources; when one changes,
+        # restore-keys brings the previous cache and only the new image is
+        # resized. A pull request can restore a cache saved on its base
+        # branch, and this workflow runs on edition, so the cache it saves
+        # is the one a new pull request starts from.
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: resources/_gen
+          key: hugo-gen-${{ hashFiles('themes/pybcn_theme/assets/images/**') }}
+          restore-keys: |
+            hugo-gen-
+
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1200064d..a6782b67 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -18,6 +18,21 @@ jobs:
       - name: Read the Hugo version
         run: echo "HUGO_VERSION=$(tr -d '[:space:]' < .hugo-version)" >> "$GITHUB_ENV"
 
+      - name: Restore the generated images
+        # A cold build resizes more than 400 images, about 90 seconds of CPU
+        # for output that is the same every time. Hugo names each generated
+        # file after a hash of the source image and the processing options,
+        # so a cached file is used only when both match and a stale entry is
+        # never served. The key follows the image sources; when one changes,
+        # restore-keys brings the previous cache and only the new image is
+        # resized.
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: resources/_gen
+          key: hugo-gen-${{ hashFiles('themes/pybcn_theme/assets/images/**') }}
+          restore-keys: |
+            hugo-gen-
+
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
@@ -55,6 +70,21 @@ jobs:
       - name: Read the Hugo version
         run: echo "HUGO_VERSION=$(tr -d '[:space:]' < .hugo-version)" >> "$GITHUB_ENV"
 
+      - name: Restore the generated images
+        # A cold build resizes more than 400 images, about 90 seconds of CPU
+        # for output that is the same every time. Hugo names each generated
+        # file after a hash of the source image and the processing options,
+        # so a cached file is used only when both match and a stale entry is
+        # never served. The key follows the image sources; when one changes,
+        # restore-keys brings the previous cache and only the new image is
+        # resized.
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: resources/_gen
+          key: hugo-gen-${{ hashFiles('themes/pybcn_theme/assets/images/**') }}
+          restore-keys: |
+            hugo-gen-
+
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:

From e6719c3ff22f5895c61c5dd929e91a620a9eea96 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:45:09 +0200
Subject: [PATCH 07/16] Drop the remote photo_url field from people

people_summary.html printed photo_url in a plain img on every page that
lists the person: the sponsor grid, the organizer pages, every event page.
Each visit loaded the image from the third party that hosts it, and told
that party the visitor's address and the page they were on. Zero of 138
people use the field, so nothing on the site changes: the organizers pages
and the canary page are byte-identical before and after.

The template reads photo only. bin/check-content reports a photo_url as an
error, with the fix in the message, so a value does not sit in the front
matter ignored in silence. The archetype and the README no longer offer the
field. The sponsor logo URL field is dropped for the same reason in the
branch this one builds on.
---
 README.md                                     |  5 ++++
 bin/check-content                             |  9 +++++-
 themes/pybcn_theme/archetypes/people.md       |  1 -
 .../layouts/partials/people_summary.html      | 29 ++++++-------------
 4 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/README.md b/README.md
index 0c17bfbc..ba578295 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,11 @@ The template iterates over the defined levels, and for each level:
 
 To add new people to the site, there is a Hugo archetype defined in `themes/pybcn_theme/archetypes/people.md` that can be used by running the command: `hugo new people/my-new-person.md`.
 
+The `photo` field names a file under `themes/pybcn_theme/assets/images/people/`.
+A remote `photo_url` is not supported: it would load from a third party on
+every page that lists the person and tell that party who viewed it, and
+`bin/check-content` reports it as an error.
+
 
 ### Monthly event page implementation details
 
diff --git a/bin/check-content b/bin/check-content
index 880e21f4..23ff8b46 100755
--- a/bin/check-content
+++ b/bin/check-content
@@ -3,7 +3,8 @@
 
 Catches the mistakes that a Hugo build does not: a person id that does not
 match its filename, a duplicate id, a page that lists a person or sponsor id
-with no page behind it, and a declared photo with no file behind it.
+with no page behind it, a declared photo with no file behind it, and a
+remote photo_url.
 
 Exit code 1 if any error is found. Warnings do not fail the build.
 
@@ -158,6 +159,12 @@ def check_photos(people):
     small = []
     for page_id, path in people.items():
         data = front_matter(path) or {}
+        # A remote photo loads from a third party on every page that lists
+        # the person and tells that party who viewed it. The template no
+        # longer reads the field, so a value here would be ignored in silence.
+        if data.get("photo_url"):
+            error(path, "photo_url is not supported: put the file under "
+                        "themes/pybcn_theme/assets/images/people/ and use 'photo'")
         photo = data.get("photo")
         if photo and not bare_file_name(path, "photo", photo):
             continue
diff --git a/themes/pybcn_theme/archetypes/people.md b/themes/pybcn_theme/archetypes/people.md
index 99df2577..e50f71bf 100644
--- a/themes/pybcn_theme/archetypes/people.md
+++ b/themes/pybcn_theme/archetypes/people.md
@@ -3,7 +3,6 @@ id = ''
 name = ''
 short_bio = ''
 photo = ''
-photo_url = ''
 
 pybcn_position = ''
 
diff --git a/themes/pybcn_theme/layouts/partials/people_summary.html b/themes/pybcn_theme/layouts/partials/people_summary.html
index 921b1bb9..7356bd87 100644
--- a/themes/pybcn_theme/layouts/partials/people_summary.html
+++ b/themes/pybcn_theme/layouts/partials/people_summary.html
@@ -4,24 +4,21 @@
     Photos come from assets/images/people/ and go through the Hugo image
     pipeline. The grid slot is 350 px wide at most and the modal caps the
     image at 400 px, so one 400 px WebP serves both, with an 800 px variant
-    for a 2x screen. A person with no photo falls back to anon_member.png. A
-    person with an external photo_url keeps a plain img, because Hugo cannot
-    process a remote file.
+    for a 2x screen. A person with no photo falls back to anon_member.png.
 
-    The modal id takes the key the grid passes in (grid, level and position),
-    because an event page can list the same person in two sections. Two
-    dialogs with one id would share it in aria-labelledby, and an id has to
-    be unique on the page.
+    A remote photo is not supported. The template used to accept photo_url
+    and print it in a plain img, which made every page that lists the person
+    load an image from a third party and tell that party who viewed it. No
+    person used the field, and bin/check-content now rejects it.
 */ -}}
 {{- $modal := printf "modal_%s" $.person.Params.id -}}
 {{- with $.key -}}{{- $modal = printf "modal_%s_%s" . $.person.Params.id -}}{{- end -}}
-{{- $photoURL := $.person.Params.photo_url -}}
 {{- $photo := $.person.Params.photo -}}
 {{- $img := "" -}}
-{{- if and (not $photoURL) $photo -}}
+{{- if $photo -}}
     {{- $img = resources.Get (printf "images/people/%s" $photo) -}}
 {{- end -}}
-{{- if not (or $photoURL $img) -}}
+{{- if not $img -}}
     {{- $img = resources.Get "images/anon_member.png" -}}
 {{- end -}}
 {{- $small := "" -}}{{- $large := "" -}}{{- $srcset := "" -}}
@@ -42,11 +39,7 @@
              user would otherwise stop twice on every card for one action. The
              photo stays clickable with a pointer. */}}
         <button type="button" class="modal_trigger" tabindex="-1" data-toggle="modal" data-target="#{{ $modal }}" aria-label="More about {{ $.person.Params.name }}">
-            {{ if $photoURL }}
-                <img class="img-fluid img-people" src="{{ $photoURL }}" loading="lazy" decoding="async" alt="{{ $.person.Params.name }}" />
-            {{ else }}
-                <img class="img-fluid img-people" src="{{ $small.RelPermalink }}"{{ with $srcset }} srcset="{{ . }}"{{ end }} width="{{ $small.Width }}" height="{{ $small.Height }}" loading="lazy" decoding="async" alt="{{ if $photo }}{{ $.person.Params.name }}{{ end }}" />
-            {{ end }}
+            <img class="img-fluid img-people" src="{{ $small.RelPermalink }}"{{ with $srcset }} srcset="{{ . }}"{{ end }} width="{{ $small.Width }}" height="{{ $small.Height }}" loading="lazy" decoding="async" alt="{{ if $photo }}{{ $.person.Params.name }}{{ end }}" />
         </button>
     </div>
     <div class="person_data">
@@ -76,11 +69,7 @@ <h3><button type="button" class="modal_trigger" data-toggle="modal" data-target=
                         <span aria-hidden="true">&times;</span>
                     </button>
                     {{/* alt is empty here: the name is in the modal heading next to it. */}}
-                    {{ if $photoURL }}
-                        <img class="img-fluid rounded float-left" src="{{ $photoURL }}" loading="lazy" decoding="async" alt="" />
-                    {{ else }}
-                        <img class="img-fluid rounded float-left" src="{{ $small.RelPermalink }}"{{ with $srcset }} srcset="{{ . }}"{{ end }} width="{{ $small.Width }}" height="{{ $small.Height }}" loading="lazy" decoding="async" alt="" />
-                    {{ end }}
+                    <img class="img-fluid rounded float-left" src="{{ $small.RelPermalink }}"{{ with $srcset }} srcset="{{ . }}"{{ end }} width="{{ $small.Width }}" height="{{ $small.Height }}" loading="lazy" decoding="async" alt="" />
                     <h3 class="modal-title" id="{{ $modal }}_title">
                         {{ $.person.Params.name }}
                         {{ if $.person.Params.twitter }}

From db2a236c493130bd110e1f49a7bca429445b751d Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:45:11 +0200
Subject: [PATCH 08/16] Remove the sponsor.html partial, which nothing calls

themes/pybcn_theme/layouts/partials/sponsor.html came in with the 2020 site
and printed a logo URL, a sponsor URL and a name into an img inside a link.
No template or shortcode calls it, and no commit on any branch ever did:
the sponsor grid has always used sponsor_summary.html. A partial that
nobody calls still reads as a way to render a sponsor with a remote logo,
which this branch is removing. The build is unchanged.
---
 themes/pybcn_theme/layouts/partials/sponsor.html | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 themes/pybcn_theme/layouts/partials/sponsor.html

diff --git a/themes/pybcn_theme/layouts/partials/sponsor.html b/themes/pybcn_theme/layouts/partials/sponsor.html
deleted file mode 100644
index f10a1847..00000000
--- a/themes/pybcn_theme/layouts/partials/sponsor.html
+++ /dev/null
@@ -1,5 +0,0 @@
-<div class="col-md-{{ .size }}">
-    <a href="{{ .sponsor_url }}" target="_blank">
-        <img src="{{ .logo }}" class="img-fluid" alt="{{ .name}}">
-    </a>
-</div>
\ No newline at end of file

From 5fb56c1934da9b44bb13f9661ab3c4e10442cd21 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 21:45:11 +0200
Subject: [PATCH 09/16] docs: describe bin/check-rendered beside the other two
 checks

What it reads, what it fails on, why reading the build catches a class of
defect the two content checks cannot, how the canary fixture works and why
the build needs -D, how to run it, and how the allowlist is keyed.
---
 README.md | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/README.md b/README.md
index ba578295..27626a4b 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,49 @@ URL the element loads, so it permits one known embed and not any later one in
 the same file, and the file that carries it needs a rule in
 `.github/CODEOWNERS`, or any contributor can edit the allowed snippet.
 
+### Rendered page check
+
+`bin/check-rendered` reads the pages Hugo built and fails on dangerous markup
+in them: an `on...=` handler on any element, a `javascript:`, `vbscript:` or
+`data:` URL in any attribute a browser loads from or navigates to (entities
+decoded, the way a browser does), an inline `<script>` or one loaded from off
+this site, an `<iframe>`, `<object>`, `<embed>` or `<base>`, a form or a `<meta
+refresh>` that sends the visitor off this site, a `style` attribute or `<style>`
+block outside a small grammar of sizes, margins and grid properties, a `<link>`,
+an image, a media file or a click beacon fetched from off this site, and the
+three pieces of markup that `html.parser` and a browser read differently.
+
+It does what the other two checks cannot. `bin/check-content` and
+`bin/check-html-safety` read `content/`, which is what an outside contributor
+can change, and that is the right place for them to stop. The worst defect
+found on this site was not there: a partial assembled the sponsor logo markup
+with `printf` and emitted it through `safeHTML`, so a sponsor name reached the
+page unescaped while every content file was clean and both content checks
+passed. Reading the output catches that class wherever it lives: a template, a
+shortcode, a partial, the theme, a Hugo internal template or the minifier.
+
+The check needs a build made with `-D`. Three draft pages are a canary: a
+sponsor and a person whose name closes the attribute it sits in and opens a
+link to `canary.invalid`, listed on `content/canary.md` through the real
+sponsor and people grids. The check fails if either name did not reach that
+page as text, or if the page is missing, so the fixture cannot disappear
+without notice. The deploy workflow builds without `-D`, so the canary never
+reaches the live site.
+
+```
+./bin/hugo --minify -D -d public
+./bin/check-rendered public
+```
+
+The standard library is enough, no `pip install`. The `pr-checks` workflow
+runs it in the `links` job, on the same build lychee checks. `ALLOWLIST` in
+the script names each accepted finding by page, kind and either the prefix of
+the URL the element loads or the SHA-256 of the inline text, with a reason:
+today the Google embeds, the PayPal form with its button image and its 1x1
+pixel, the Eventbrite button of PyDay 2018, and two inline scripts in the
+frozen archives. An entry that no longer matches anything is reported as
+stale, so it gets deleted.
+
 
 This is a work in progress. All the design and implementation decisions are detailed in [Proposta d'estructura](https://docs.google.com/document/d/10YxQeCuGQXUjnN3o9e1oH2HJkrhxJsr31qnxO_aiCNM/edit?usp=sharing) (currently written in catalan). All the tasks are managed through our [private Trello board](https://trello.com/b/cFE8KRTS).
 

From ffdbdfc60bf9aacdd48ad6c929224c7729653b2a Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Sun, 4 Oct 2026 23:33:50 +0200
Subject: [PATCH 10/16] Remove the PayPal tracking pixel from the membership
 form

The membership and the cancel pages each loaded a 1x1 GIF from
paypalobjects.com on page load, before any interaction. It is removed,
along with the two allowlist entries that covered it.

What it is. 43 bytes, GIF89a 1x1, no query string and no per merchant or
per page parameter, cached publicly for a year, and it sets no cookie: the
same file for every merchant that uses PayPal. It is a plain img with no
name attribute, so it was never part of the form submission and removing
it cannot affect a payment. The three fields that matter, cmd,
hosted_button_id and submit, are untouched.

Where it came from. Nobody here chose it. It arrived inside PayPal's own
generated button snippet in the commit that published this site on
2020-12-03, which changed 434 files, and a later commit only moved the
block into this shortcode. PayPal's current button generator emits a
JavaScript SDK snippet with no form and no pixel.

What PayPal says about it: nothing. It appears in every generator sample
in their Website Payments Standard guides, from the 2008 integration guide
to the 2019 classic docs, and it is absent from the HTML variables
reference. In Form Basics every other line of the example carries an
explaining HTML comment and this one does not. The only statement of
purpose that exists anywhere is a 2009 post on PayPal's community forum by
a volunteer, not staff, saying it is for internal traffic monitoring and
is optional. Every later summary on the web traces back to that sentence.

So the honest claim is that PayPal has never documented a function for it,
not that PayPal confirms it is unused.

Be clear about how little this buys. The button image is fetched from the
same host on the same page load, with the same headers and the same
absence of a cookie, so PayPal already learns of the page view. Removing
the pixel changes that by almost nothing. For a page that makes no request
to PayPal before a click, the button image has to be self hosted too, and
that changes the control that submits the form, which is not worth the
risk for one 43 byte request.
---
 bin/check-rendered                                    | 10 ----------
 layouts/shortcodes/membership/membership-process.html |  1 -
 2 files changed, 11 deletions(-)

diff --git a/bin/check-rendered b/bin/check-rendered
index a00e00cc..a714ccce 100755
--- a/bin/check-rendered
+++ b/bin/check-rendered
@@ -455,20 +455,10 @@ ALLOWLIST = [
      "kind": "load",
      "prefix": "https://www.paypalobjects.com/en_US/GB/i/btn/btn_subscribeCC_LG.gif",
      "why": "the PayPal button image of the membership-process shortcode"},
-    {"path": "pybcn_association/membership/index.html",
-     "kind": "load",
-     "prefix": "https://www.paypalobjects.com/es_ES/i/scr/pixel.gif",
-     "why": "the 1x1 pixel PayPal ships inside its button snippet. It tells PayPal "
-            "who viewed the page and the button works without it; dropping it from "
-            "the shortcode is a decision for @pybcn/core"},
     {"path": "pybcn_association/membership-cancel/index.html",
      "kind": "load",
      "prefix": "https://www.paypalobjects.com/en_US/GB/i/btn/btn_subscribeCC_LG.gif",
      "why": "the PayPal button image of the membership-process shortcode"},
-    {"path": "pybcn_association/membership-cancel/index.html",
-     "kind": "load",
-     "prefix": "https://www.paypalobjects.com/es_ES/i/scr/pixel.gif",
-     "why": "the same PayPal pixel, on the unsubscribe page"},
     {"path": "events/pyday_bcn/pyday_bcn_2018/index.html",
      "kind": "load",
      "prefix": "https://www.eventbrite.es/custombutton?eid=50585714233",
diff --git a/layouts/shortcodes/membership/membership-process.html b/layouts/shortcodes/membership/membership-process.html
index 4fa59f02..1417681f 100644
--- a/layouts/shortcodes/membership/membership-process.html
+++ b/layouts/shortcodes/membership/membership-process.html
@@ -9,6 +9,5 @@
         <input type="hidden" name="cmd" value="_s-xclick">
         <input type="hidden" name="hosted_button_id" value="6XH6B9ZGJ4PQA">
         <input type="image" src="https://www.paypalobjects.com/en_US/GB/i/btn/btn_subscribeCC_LG.gif" border="0" name="submit" alt="PayPal – The safer, easier way to pay online!">
-        <img alt="" border="0" src="https://www.paypalobjects.com/es_ES/i/scr/pixel.gif" width="1" height="1">
     </form>
 </div>
\ No newline at end of file

From 1fefd5b3d7b0af8636dce9f8c538861f9f5734ed Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Mon, 5 Oct 2026 00:06:37 +0200
Subject: [PATCH 11/16] check-rendered: validate an unclosed style or script at
 end of file

check_style_block runs only from handle_endtag, so a <style> left open at
end of file reached no validation and passed in silence, against the rule
that a stylesheet property outside the grammar is a decision and not a
silent pass. A browser applies an unclosed stylesheet and runs an unclosed
script, so finish_collecting now runs again from close() and gives the
leftover block a verdict.

Not reachable from a content pull request today: bin/check-html-safety
blocks a raw <style> in content, and hugo --minify emits balanced blocks.
This closes the gap for any future template or minifier change.
---
 bin/check-rendered | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/bin/check-rendered b/bin/check-rendered
index a714ccce..4713401e 100755
--- a/bin/check-rendered
+++ b/bin/check-rendered
@@ -642,15 +642,32 @@ class Page(HTMLParser):
         if tag in self.FOREIGN and self.foreign:
             self.foreign -= 1
         if self.collecting is not None and tag in ("script", "style"):
-            finding, pieces = self.collecting
-            self.collecting = None
-            body = "".join(pieces)
-            if finding is not None:
-                finding["body"] = body
-            else:
-                accepted, note = check_style_block(body)
-                if not accepted:
-                    self.record("style-block", body=body, note=note)
+            self.finish_collecting()
+
+    def finish_collecting(self, at_eof=False):
+        """Validate the body of the open <script> or <style> and close it.
+
+        A <style> is checked only here, so a block left open never reached
+        this path from handle_endtag. close() calls it again at end of file:
+        a browser applies an unclosed stylesheet and runs an unclosed script,
+        so an unterminated block gets a decision, not a silent pass.
+        """
+        if self.collecting is None:
+            return
+        finding, pieces = self.collecting
+        self.collecting = None
+        body = "".join(pieces)
+        if finding is not None:
+            finding["body"] = body
+        else:
+            accepted, note = check_style_block(body)
+            if not accepted:
+                text = "<style> (unclosed at end of file)" if at_eof else None
+                self.record("style-block", body=body, note=note, text=text)
+
+    def close(self):
+        super().close()
+        self.finish_collecting(at_eof=True)
 
     def handle_data(self, data):
         self.values.append(data)

From 58f455a306cc53afa5cb55f66f926e1a3ba06cec Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Mon, 5 Oct 2026 00:07:55 +0200
Subject: [PATCH 12/16] docs: drop the removed 1x1 pixel from the
 check-rendered allowlist list

The README section was written one commit before the PayPal tracking pixel
and its two allowlist entries were removed, so it still named the 1x1 pixel
among the allowed findings. It is gone, so the sentence no longer lists it.
---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 27626a4b..f0fc920f 100644
--- a/README.md
+++ b/README.md
@@ -153,9 +153,9 @@ The standard library is enough, no `pip install`. The `pr-checks` workflow
 runs it in the `links` job, on the same build lychee checks. `ALLOWLIST` in
 the script names each accepted finding by page, kind and either the prefix of
 the URL the element loads or the SHA-256 of the inline text, with a reason:
-today the Google embeds, the PayPal form with its button image and its 1x1
-pixel, the Eventbrite button of PyDay 2018, and two inline scripts in the
-frozen archives. An entry that no longer matches anything is reported as
+today the Google embeds, the PayPal form with its button image, the
+Eventbrite button of PyDay 2018, and two inline scripts in the frozen
+archives. An entry that no longer matches anything is reported as
 stale, so it gets deleted.
 
 

From abbf1793d757b52f901d921398c6b2d073f83a15 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Mon, 5 Oct 2026 00:13:03 +0200
Subject: [PATCH 13/16] ci: fix the indentation inside the lychee argument
 block

One --exclude line sat two spaces deeper than the rest. In a YAML folded
scalar a more indented line is not folded, so the argument string carried
two literal newlines where it looked like it carried spaces.

It worked, because the shell treats a newline as whitespace when it splits
the arguments, so lychee received the same 19 tokens either way, and the
run on the pull request was green. But the file did not say what it looked
like it said, and an edit near those lines could turn a harmless newline
into a real one.
---
 .github/workflows/pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index a6782b67..7e1e84ed 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -125,7 +125,7 @@ jobs:
             --exclude 'twitter\.com'
             --exclude '^https?://(www\.)?x\.com/'
             --exclude 'linkedin\.com'
-              --exclude 'pybcn\.slack\.com'
+            --exclude 'pybcn\.slack\.com'
             --exclude 'canary\.invalid'
             'public/**/*.html'
           # External sites rate-limit. Keep the report in the job summary and

From 175569262668db5ce565aea20345429df2c8c5e1 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Mon, 5 Oct 2026 14:38:12 +0200
Subject: [PATCH 14/16] README: say how to collaborate, and what the checks are
 for

A contributor had no written path from a clone to a merged pull request, and
no way to know what the checks do before one of them fails. The section lists
the steps, the command for each check, and what each one catches.

Asked for in review of #193.
---
 README.md | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/README.md b/README.md
index f0fc920f..9c073f61 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,47 @@ Once the site was archived, you can create a new link in the navigational menu u
 
 ## Information for developers
 
+### Collaborate
+
+A change to this site goes through a pull request. Nothing is pushed to
+`edition` directly.
+
+1. Clone the repository. `git clone --single-branch --branch edition` is enough
+   and skips the built site, which lives on its own branch.
+2. Run `bin/install`. It downloads the pinned Hugo binary into `bin/hugo` and
+   verifies its checksum. You do not need Python, Go, or npm for this step.
+3. Run `bin/serve` to see the site at `http://localhost:1313` while you work.
+4. Make the change.
+5. Run the three checks locally, so you find what the pull request would find:
+
+   ```
+   pip install pyyaml
+   bin/check-content
+   bin/check-html-safety
+   bin/hugo --minify -D -d public && bin/check-rendered
+   ```
+
+6. Open the pull request against `edition`.
+
+The `pr-checks` workflow then runs the same checks on your branch, plus a build
+and a link check. **All of them have to pass**, and one approving review is
+needed before the pull request can be merged. The paths listed in
+`.github/CODEOWNERS` also request a review from the web team automatically.
+
+What each check is for:
+
+| Check | Fails when |
+|---|---|
+| Build the site | Hugo cannot build, or emits a warning |
+| `bin/check-content` | Front matter does not parse, a person `id` does not match its filename, an id is duplicated, a declared photo is missing, or an event references a person or sponsor that does not exist |
+| `bin/check-html-safety` | Content carries raw HTML that turns a content change into script execution, a redirect, a credential prompt, or a page overlay |
+| `bin/check-rendered` | The built pages carry that same markup, which catches a template that produces it even when no content file does |
+| Check the links | Reported, never blocking, because external sites rate-limit |
+
+A merge to `edition` deploys the site. The `github-pages` workflow builds it and
+publishes the result, so a change is live within a few minutes of the merge.
+
+
 ### Content safety check
 
 `bin/check-html-safety` scans `content/` and fails if it finds raw HTML that

From 8675ebe8d1734acec345f4ae76706353a3e72ad6 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Mon, 5 Oct 2026 14:38:23 +0200
Subject: [PATCH 15/16] README: drop the line that says we want no contributors

It sat four paragraphs below a section that explains how to contribute. The
association does want the help, and the line is old enough that nobody knows
which period it refers to.
---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index 9c073f61..b17da5d2 100644
--- a/README.md
+++ b/README.md
@@ -202,7 +202,6 @@ stale, so it gets deleted.
 
 This is a work in progress. All the design and implementation decisions are detailed in [Proposta d'estructura](https://docs.google.com/document/d/10YxQeCuGQXUjnN3o9e1oH2HJkrhxJsr31qnxO_aiCNM/edit?usp=sharing) (currently written in catalan). All the tasks are managed through our [private Trello board](https://trello.com/b/cFE8KRTS).
 
-For now, we are not looking for contributors yet.
 
 
 ### Using JS code

From 2418c1923080e778b96f6c4983cd0595e0ee7e08 Mon Sep 17 00:00:00 2001
From: David Arcos <david.arcos@gmail.com>
Date: Mon, 5 Oct 2026 14:55:26 +0200
Subject: [PATCH 16/16] check-content: report a security.txt that is about to
 expire

RFC 9116 makes Expires mandatory and tells a reader to treat the file as
stale once the date passes. Nothing else would notice: the file keeps
serving a 200 and keeps looking correct, and the date is a year away when it
is written, which is about how long it takes to forget it.

A warning 30 days out, an error once it has passed.

Ours expires on 2027-09-30, so this is silent today. Verified against both
cases by moving the date.
---
 bin/check-content | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/bin/check-content b/bin/check-content
index 23ff8b46..3d996ac9 100755
--- a/bin/check-content
+++ b/bin/check-content
@@ -12,6 +12,7 @@ Usage:
     bin/check-content
 """
 
+import datetime
 import pathlib
 import re
 import struct
@@ -332,6 +333,43 @@ def check_orphans(people, listed_people):
             warn(path, f"person '{page_id}' is not listed by any event or page")
 
 
+SECURITY_TXT = ROOT / "static" / ".well-known" / "security.txt"
+SECURITY_TXT_NOTICE_DAYS = 30
+
+
+def check_security_txt():
+    """Report a security.txt that has expired, or is about to.
+
+    RFC 9116 makes Expires mandatory and says a reader should treat the file
+    as stale once that date passes. Nothing else would notice: the file keeps
+    serving a 200 and keeps looking correct, and the date is a year away when
+    it is written, which is exactly how long it takes to forget it.
+    """
+    if not SECURITY_TXT.exists():
+        return
+    expires = None
+    for line in SECURITY_TXT.read_text(encoding="utf-8").splitlines():
+        if line.lower().startswith("expires:"):
+            expires = line.split(":", 1)[1].strip()
+            break
+    if not expires:
+        error(SECURITY_TXT, "no Expires field, which RFC 9116 requires")
+        return
+    try:
+        when = datetime.datetime.fromisoformat(expires.replace("Z", "+00:00"))
+    except ValueError:
+        error(SECURITY_TXT, f"Expires is not a date this can read: '{expires}'")
+        return
+    left = (when - datetime.datetime.now(datetime.timezone.utc)).days
+    if left < 0:
+        error(SECURITY_TXT, f"expired {-left} days ago, on {when.date()}. "
+                            "A reader treats the whole file as stale. Set a new "
+                            "Expires, at most a year away.")
+    elif left <= SECURITY_TXT_NOTICE_DAYS:
+        warn(SECURITY_TXT, f"expires in {left} days, on {when.date()}. "
+                           "Set a new Expires before it does.")
+
+
 def main():
     people = collect_ids("people")
     sponsors = collect_ids("sponsors")
@@ -340,6 +378,7 @@ def main():
     listed_people = check_listings(people, sponsors)
     check_agenda()
     check_orphans(people, listed_people)
+    check_security_txt()
 
     for line in warnings:
         print(f"WARNING  {line}")