From c83ae3c9afc2d506d09427589fd8c5a3f778bf6f Mon Sep 17 00:00:00 2001 From: Nour Agha Date: Thu, 15 Oct 2026 18:13:53 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Add=20optional=20SRI=20support?= =?UTF-8?q?=20for=20Umami=20Analytics?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config/_default/params.toml | 1 + exampleSite/config/_default/params.toml | 1 + exampleSite/content/docs/configuration/index.it.md | 1 + exampleSite/content/docs/configuration/index.ja.md | 1 + exampleSite/content/docs/configuration/index.md | 1 + exampleSite/content/docs/configuration/index.zh-cn.md | 1 + exampleSite/content/docs/partials/index.it.md | 5 +++++ exampleSite/content/docs/partials/index.ja.md | 5 +++++ exampleSite/content/docs/partials/index.md | 5 +++++ exampleSite/content/docs/partials/index.zh-cn.md | 4 ++++ layouts/partials/analytics/umami.html | 8 ++++++++ 11 files changed, 33 insertions(+) diff --git a/config/_default/params.toml b/config/_default/params.toml index 5cc8342b..b7cedef1 100644 --- a/config/_default/params.toml +++ b/config/_default/params.toml @@ -182,6 +182,7 @@ forgejoDefaultServer = "https://v11.next.forgejo.org" # dataDomains = "yoursite.com,yoursite2.com" # scriptName = "" # enableTrackEvent = true + # integrity = "sha384-YOUR_HASH" [selineAnalytics] # token = "XXXXXX" diff --git a/exampleSite/config/_default/params.toml b/exampleSite/config/_default/params.toml index 2811584c..4bc80911 100644 --- a/exampleSite/config/_default/params.toml +++ b/exampleSite/config/_default/params.toml @@ -157,6 +157,7 @@ fingerprintAlgorithm = "sha512" # Valid values are "sha512" (default), "sha384", # dataDomains = "yoursite.com,yoursite2.com" # scriptName = "" # enableTrackEvent = false + # integrity = "sha384-YOUR_HASH" [selineAnalytics] # token = "XXXXXX" diff --git a/exampleSite/content/docs/configuration/index.it.md b/exampleSite/content/docs/configuration/index.it.md index 59da8497..085bd1ba 100644 --- a/exampleSite/content/docs/configuration/index.it.md +++ b/exampleSite/content/docs/configuration/index.it.md @@ -342,6 +342,7 @@ Many of the article defaults here can be overridden on a per article basis by sp | `umamiAnalytics.dataDomains` | _Not set_ | If you want the tracker to only run on specific domains, provide it for your tracker script. This is a comma delimited list of domain names. Such as "yoursite.com,yoursite2.com". | | `umamiAnalytics.scriptName` | script.js | The name of the `script.js` used for anti-ad-blocking is configured by the environment variable `TRACKER_SCRIPT_NAME` | | `umamiAnalytics.enableTrackEvent` | true | When set to `true` track event will add automatically. If you do not want to add track event, set it to `false`. | +| `umamiAnalytics.integrity` | _Not set_ | Optional SRI hash for the Umami tracking script. When configured, the script uses `crossorigin="anonymous"`. The script host must support CORS, and the hash must be updated whenever the script changes. | ### Seline Analytics diff --git a/exampleSite/content/docs/configuration/index.ja.md b/exampleSite/content/docs/configuration/index.ja.md index 143a9779..78f1b109 100644 --- a/exampleSite/content/docs/configuration/index.ja.md +++ b/exampleSite/content/docs/configuration/index.ja.md @@ -342,6 +342,7 @@ Blowfish は、テーマの機能を制御する多数の設定パラメータ | `umamiAnalytics.dataDomains` | _未設定_ | トラッカーを特定のドメインでのみ実行したい場合は、トラッカースクリプトに指定します。これは、ドメイン名のカンマ区切りリストです。例えば "yoursite.com,yoursite2.com" のようになります。 | | `umamiAnalytics.scriptName` | script.js | アンチ広告ブロックに使用される `script.js` の名前は、環境変数 `TRACKER_SCRIPT_NAME` で設定されます。 | | `umamiAnalytics.enableTrackEvent` | `true` | `true` に設定すると、トラックイベントが自動的に追加されます。トラックイベントを追加したくない場合は、`false` に設定してください。 | +| `umamiAnalytics.integrity` | _未設定_ | Umami トラッキングスクリプトのオプションの SRI ハッシュ。設定すると `crossorigin="anonymous"` が追加されます。スクリプトの配信元は CORS に対応している必要があり、スクリプトが変更された場合はハッシュの更新が必要です。 | ### Seline Analytics diff --git a/exampleSite/content/docs/configuration/index.md b/exampleSite/content/docs/configuration/index.md index c3c724e4..85164224 100644 --- a/exampleSite/content/docs/configuration/index.md +++ b/exampleSite/content/docs/configuration/index.md @@ -404,6 +404,7 @@ Many of the article defaults here can be overridden on a per article basis by sp | `umamiAnalytics.dataDomains` | _Not set_ | If you want the tracker to only run on specific domains, provide it for your tracker script. This is a comma delimited list of domain names. Such as "yoursite.com,yoursite2.com". | | `umamiAnalytics.scriptName` | script.js | The name of the `script.js` used for anti-ad-blocking is configured by the environment variable `TRACKER_SCRIPT_NAME` | | `umamiAnalytics.enableTrackEvent` | true | When set to `true` track event will add automatically. If you do not want to add track event, set it to `false`. | +| `umamiAnalytics.integrity` | _Not set_ | Optional SRI hash for the Umami tracking script. When configured, the script uses `crossorigin="anonymous"`. The script host must support CORS, and the hash must be updated whenever the script changes. | ### Seline Analytics diff --git a/exampleSite/content/docs/configuration/index.zh-cn.md b/exampleSite/content/docs/configuration/index.zh-cn.md index a37335dc..8f27af6e 100644 --- a/exampleSite/content/docs/configuration/index.zh-cn.md +++ b/exampleSite/content/docs/configuration/index.zh-cn.md @@ -346,6 +346,7 @@ Blowfish 提供了大量控制主题功能的配置参数，下面的表格中 | `umamiAnalytics.dataDomains` | 无 | 如果你只想在特别的数个域名中使用 tracker 功能，那么你需要设置它。这个参数的值是逗号分隔的域名列表，如：yoursite.com,yoursite2.com。 | | `umamiAnalytics.scriptName` | script.js | 用于反广告屏蔽的 script.js 名称，由环境变量 `TRACKER_SCRIPT_NAME` 配置。 | | `umamiAnalytics.enableTrackEvent` | true | 默认会自动添加 Umami Track Event。如果你不想添加 Event，那学需要设置为 `false`。 | +| `umamiAnalytics.integrity` | 无 | Umami 跟踪脚本的可选 SRI 哈希值。配置后会自动添加 `crossorigin="anonymous"`。脚本服务器必须支持 CORS，且脚本内容发生变化时需要更新哈希值。 | ### Seline Analytics diff --git a/exampleSite/content/docs/partials/index.it.md b/exampleSite/content/docs/partials/index.it.md index 1074bd1a..116ff353 100644 --- a/exampleSite/content/docs/partials/index.it.md +++ b/exampleSite/content/docs/partials/index.it.md @@ -47,8 +47,12 @@ To enable Umami Analytics support, simply provide your [Umami tracking code](htt If you also use the custom domain feature of Umami and would like to serve their script from your domain, you can also additionally provide the `domain` configuration value. If you don't provide a `domain` value, the script will load directly from Umami DNS (analytics.umami.is). If you want the tracker to only run on specific domains, you can provide the `dataDomains` configuration value. If you don't provide a `dataDomains` value, the script will run on any website where the `domain` and`websiteid` match. If the environment variable `TRACKER_SCRIPT_NAME` is configured, you can specify a custom script name `scriptName`. If it is not configured, either comment it out or use the default `script.js`. +To enable optional Subresource Integrity (SRI), set the `integrity` parameter to a valid SHA-256, SHA-384, or SHA-512 hash. Blowfish automatically adds `crossorigin="anonymous"` when an integrity hash is provided. + {{< alert >}} **Note:** If you enable Umami Analytics, Blowfish will support [Umami Track Event](https://umami.is/docs/track-events) automatically. If you do not want to support Track Event, the param `enableTrackEvent` must set to `false`. + +**SRI:** The script host must support CORS. If the upstream script changes, the integrity hash must be updated; otherwise, browsers will block the script and analytics tracking will stop. {{< /alert >}} ```toml @@ -60,6 +64,7 @@ If you want the tracker to only run on specific domains, you can provide the `da dataDomains = "yoursite.com,yoursite2.com" scriptName = "TRACKER_SCRIPT_NAME" enableTrackEvent = true + # integrity = "sha384-YOUR_HASH" ``` ### Seline Analytics diff --git a/exampleSite/content/docs/partials/index.ja.md b/exampleSite/content/docs/partials/index.ja.md index 90fdf14c..ff4f502f 100644 --- a/exampleSite/content/docs/partials/index.ja.md +++ b/exampleSite/content/docs/partials/index.ja.md @@ -47,8 +47,12 @@ Umami Analytics のサポートを有効にするには、`config/_default/param Umami のカスタムドメイン機能を使用していて、ドメインからスクリプトを配信したい場合は、追加で `domain` 設定値を指定することもできます。`domain` 値を指定しない場合、スクリプトは Umami DNS (analytics.umami.is) から直接ロードされます。 トラッカーを特定のドメインでのみ実行したい場合は、`dataDomains` 設定値を指定できます。`dataDomains` 値を指定しない場合、スクリプトは `domain` と `websiteid` が一致する任意のウェブサイトで実行されます。環境変数 `TRACKER_SCRIPT_NAME` が設定されている場合は、カスタムスクリプト名 `scriptName` を指定できます。設定されていない場合は、コメントアウトするか、デフォルトの `script.js` を使用してください。 +Subresource Integrity (SRI) を有効にするには、オプションの `integrity` パラメータに SHA-256、SHA-384、または SHA-512 ハッシュを指定します。Blowfish は自動的に `crossorigin="anonymous"` を追加します。 + {{< alert >}} **注:** Umami Analytics を有効にすると、Blowfish は [Umami トラックイベント](https://umami.is/docs/track-events)を自動的にサポートします。トラックイベントをサポートしたくない場合は、パラメータ `enableTrackEvent` を `false` に設定する必要があります。 + +**SRI:** スクリプトの配信元は CORS に対応している必要があります。スクリプトが更新された場合は、整合性ハッシュも更新する必要があります。更新しないと、ブラウザがスクリプトをブロックし、アクセス解析が停止します。 {{< /alert >}} ```toml @@ -60,6 +64,7 @@ Umami のカスタムドメイン機能を使用していて、ドメインか dataDomains = "yoursite.com,yoursite2.com" scriptName = "TRACKER_SCRIPT_NAME" enableTrackEvent = true + # integrity = "sha384-YOUR_HASH" ``` ### Seline Analytics diff --git a/exampleSite/content/docs/partials/index.md b/exampleSite/content/docs/partials/index.md index f02c60a9..b52bf81a 100644 --- a/exampleSite/content/docs/partials/index.md +++ b/exampleSite/content/docs/partials/index.md @@ -49,8 +49,12 @@ If you want the tracker to only run on specific domains, you can provide the `da If you want to honor the Do Not Track setting of the users browser, you have to set `doNotTrack` to `true`. Blowfish does not honor the Do Not Track setting per default. +To enable Subresource Integrity (SRI) for the Umami tracking script, set the optional `integrity` parameter to a valid SHA-256, SHA-384, or SHA-512 hash. Blowfish will automatically add `crossorigin="anonymous"` when this parameter is configured. + {{< alert >}} **Note:** If you enable Umami Analytics, Blowfish will support [Umami Track Event](https://umami.is/docs/track-events) automatically. If you do not want to support Track Event, the param `enableTrackEvent` must set to `false`. + +**SRI:** The script host must support CORS. If the upstream script changes, the integrity hash must be updated; otherwise, browsers will block the script and analytics tracking will stop. {{< /alert >}} ```toml @@ -63,6 +67,7 @@ If you want to honor the Do Not Track setting of the users browser, you have to scriptName = "TRACKER_SCRIPT_NAME" enableTrackEvent = true doNotTrack = false + # integrity = "sha384-YOUR_HASH" ``` ### Seline Analytics diff --git a/exampleSite/content/docs/partials/index.zh-cn.md b/exampleSite/content/docs/partials/index.zh-cn.md index f49cedf6..c87f1d17 100644 --- a/exampleSite/content/docs/partials/index.zh-cn.md +++ b/exampleSite/content/docs/partials/index.zh-cn.md @@ -48,9 +48,12 @@ googleAnalytics = "G-MEASUREMENT_ID" 如果你想使用自定义域名来获取跟踪脚本， 那么需要提供 `domain` 参数，否则会从 Umami 云服务版的地址 (analytics.umami.is) 获取脚本。 如果你只想在特别的数个域名中使用 tracker 功能，那么需要提供 `dataDomains` 参数。否则任何一个匹配了 `websiteid` 和 `domain` 参数值的网站，Umami 脚本都会执行。如果环境变量配置了 `TRACKER_SCRIPT_NAME` 可以填写自定义的脚本名称 `scriptName`，如果没有配置就注释掉或者填写默认的 `script.js` 。 +要启用子资源完整性（SRI），可以通过可选的 `integrity` 参数设置 SHA-256、SHA-384 或 SHA-512 哈希值。Blowfish 会自动添加 `crossorigin="anonymous"` 属性。 + {{< alert >}} **Note:** 开启 Umami 网站分析后, Blowfish 会自动支持 [Umami 事件追踪](https://umami.is/docs/track-events)。如果你不想支持此功能，需要把参数 `enableTrackEvent` 设置为 `false`。 +**SRI：** 脚本服务器必须支持 CORS。如果上游脚本发生变化，必须更新完整性哈希值，否则浏览器将阻止加载该脚本，导致网站分析功能停止工作。 {{< /alert >}} ```toml @@ -62,6 +65,7 @@ googleAnalytics = "G-MEASUREMENT_ID" dataDomains = "yoursite.com,yoursite2.com" scriptName = "TRACKER_SCRIPT_NAME" enableTrackEvent = true + # integrity = "sha384-YOUR_HASH" ``` ### Seline diff --git a/layouts/partials/analytics/umami.html b/layouts/partials/analytics/umami.html index 4c987043..ac7696e0 100644 --- a/layouts/partials/analytics/umami.html +++ b/layouts/partials/analytics/umami.html @@ -4,6 +4,10 @@ data-id="umami-script" async src="https://{{ site.Params.umamiAnalytics.domain }}/{{ with site.Params.umamiAnalytics.scriptName }}{{ . }}{{ else }}script.js{{ end }}" + {{ with site.Params.umamiAnalytics.integrity }} + integrity="{{ . }}" + crossorigin="anonymous" + {{ end }} data-website-id="{{ site.Params.umamiAnalytics.websiteid }}" {{ with site.Params.umamiAnalytics.dataDomains }}data-domains="{{ . }}"{{ end }} data-do-not-track="{{ site.Params.umamiAnalytics.doNotTrack | default false }}"> @@ -12,6 +16,10 @@ data-id="umami-script" async src="https://analytics.umami.is/script.js" + {{ with site.Params.umamiAnalytics.integrity }} + integrity="{{ . }}" + crossorigin="anonymous" + {{ end }} data-website-id="{{ site.Params.umamiAnalytics.websiteid }}" data-do-not-track="{{ site.Params.umamiAnalytics.doNotTrack | default false }}"> {{ end }}