github.com/troglobit / digit

Rendered READMEs pass absolute <img> URLs straight through, so visitors
fetch CI badges from github.com, leaking their IP/referer and triggering
SameSite cookie-rejected warnings.  Note a camo-style same-origin proxy
as the fix.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

diff --git a/TODO.org b/TODO.org
index a4a4006..4e0ddf2 100644
--- a/TODO.org
+++ b/TODO.org
@@ -132,6 +132,15 @@ populate it from the GitHub/GitLab org profile.  Maybe also an
 ** TODO Social icons in navbar
 =nav.links= renders text links today; icons need a small bundled
 icon set (or user-supplied SVGs in the static override dir).
+** TODO Proxy remote README images (camo-style)
+Rendered READMEs pass through absolute =<img>= URLs, so a visitor's
+browser fetches CI badges etc. straight from github.com — leaking
+their IP/referer and spewing "cookie rejected (SameSite)" warnings
+from third-party =Set-Cookie=.  GitHub avoids this by proxying every
+image through its =camo= service.  Digit could fetch + cache + re-serve
+same-origin (with content-type sniffing and an SSRF guard on the
+fetch).  Until then, a quick partial win is =referrerpolicy="no-referrer"=
+on rendered images to at least stop the referer leak.
 ** DONE Blame view
 Easy with =git blame --porcelain=, but page rendering gets heavy on
 large files.  Only if someone actually asks for it.