From 01211927959372021933c2a05bbc0f44e2f1e8ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Julien=20D=C3=A9ramond?= <juderamond@gmail.com>
Date: Sat, 10 Oct 2026 20:36:06 +0200
Subject: [PATCH 1/2] ci: restrict workflow token permissions to read

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/integration.yml | 3 +++
 .github/workflows/lint.yml        | 3 +++
 .github/workflows/weekly.yml      | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index c34bbe0c..2c7d585d 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -9,6 +9,9 @@ on:
       - main
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Integration
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8dd9be4c..c502f685 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -9,6 +9,9 @@ on:
       - main
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Lint
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index 8589a80c..02762b4c 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 12 * * Mon'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   showcase:
     name: Update Showcase Sites

From ca90e3f83c42052486a04b58d5e200e9ef34ce5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Julien=20D=C3=A9ramond?= <juderamond@gmail.com>
Date: Sat, 10 Oct 2026 20:36:07 +0200
Subject: [PATCH 2/2] fix(feeds): tighten script removal in feed HTML

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/feeds.ts        | 14 ++++++++++++--
 tests/feeds.test.ts |  5 +++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/feeds.ts b/src/feeds.ts
index 75456a3d..aa5fc641 100644
--- a/src/feeds.ts
+++ b/src/feeds.ts
@@ -109,10 +109,20 @@ export function guideItems(entries: Entry[]): FeedItem[] {
 		.sort(newestFirst);
 }
 
+/** `html` without its `<script>` elements, in any case, repeated until none is left. */
+function withoutScripts(html: string): string {
+	let out = html;
+	let before: string;
+	do {
+		before = out;
+		out = out.replace(/<script\b[^>]*>[\s\S]*?<\/script[^>]*>/gi, '');
+	} while (out !== before);
+	return out;
+}
+
 /** HTML for a feed reader: no scripts, and site-relative links and images made absolute. */
 export function feedHtml(html: string): string {
-	return html
-		.replace(/<script\b[\s\S]*?<\/script>/g, '')
+	return withoutScripts(html)
 		.replace(/\b(href|src)="(\/(?!\/)[^"]*)"/g, (_, attr, path) => `${attr}="${absolute(path)}"`)
 		.replace(
 			/\bsrcset="([^"]*)"/g,
diff --git a/tests/feeds.test.ts b/tests/feeds.test.ts
index 99ff986b..280271fc 100644
--- a/tests/feeds.test.ts
+++ b/tests/feeds.test.ts
@@ -61,4 +61,9 @@ describe('feeds', () => {
 			'<a href="https://openresource.dev/guide/">g</a><img src="https://openresource.dev/i.png" srcset="https://openresource.dev/a.png 1x, https://openresource.dev/b.png 2x"><a href="//x.y">z</a>'
 		);
 	});
+
+	test('feedHtml removes scripts in any case, with attributes, and nested ones', () => {
+		expect(feedHtml('<p>a</p><SCRIPT type="module">x()</SCRIPT ><p>b</p>')).toBe('<p>a</p><p>b</p>');
+		expect(feedHtml('<scr<script>x()</script>ipt>y()</script><p>c</p>')).toBe('<p>c</p>');
+	});
 });