Class: Abqari::Audit::Privacy

Inherits:
Rule
  • Object
show all
Defined in:
lib/abqari/audit/privacy.rb

Overview

Privacy rule. Surfaces every cross-origin resource referenced from rendered HTML (src/href to a host other than the site's own). Info-severity because external loads are a deliberate choice, not always a bug — but each one is a third-party tracking vector worth auditing.

No-ops when config.url isn't set (we can't tell what "external" means without knowing what's internal).

Instance Method Summary collapse

Methods inherited from Rule

#initialize

Constructor Details

This class inherits a constructor from Abqari::Audit::Rule

Instance Method Details

#run ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/abqari/audit/privacy.rb', line 16

def run
  site_host = host_for(@site.config['url'])
  return unless site_host

  seen = Set.new

  html_files.each do |file|
    url  = page_url(file)
    html = File.read(file, encoding: 'UTF-8')

    html.scan(%r{(?:src|href)="(https?://[^"]+)"}).each do |(external_url)|
      ext_host = host_for(external_url)
      next if ext_host.nil? || ext_host == site_host

      key = "#{url}|#{external_url}"
      next if seen.include?(key)

      seen << key
      add(category: 'privacy', severity: 'info', location: url,
          message: "External resource loaded: #{external_url}",
          suggestion: 'Consider self-hosting to avoid third-party tracking')
    end
  end
end