max / makenotwork

Refuse the reveal and repeat scripts on an embed An embed carries no script. quasi 0.59.0 and 0.60.0 added the reveal and repeat transports, both independent of htmx by design, so without_htmx does not drop them and each has to be refused by name. Two embed tests caught it: an_embed_document_carries_no_script, and the player's assertion that it holds exactly one script of its own. Both shells refuse them now, and the comment says six calls rather than four.

Author: Max Johnson <me@maxj.phd> · 2026-08-25 20:25 UTC

Signed with PGP, not checked

Commit: 141ee29baa725ab3133373deeaa48efa2c3a64e3

Parent: e375901

1 file changed, +11 insertions, -5 deletions

M server/src/quasi/embeds.rs +11 -5

			@@ -110,15 +110,19 @@
110	110		// A document that does ask fails visibly on the first control pressed,
111	111		// and nothing here asks: every control is an external link.
112	112		//
113		-	// Four `without_` calls rather than three since quasi 0.54.0, which
114		-	// added the fill script. It is independent of htmx by design — a
115		-	// deposit is two attributes on a control — so dropping the transport
116		-	// does not drop it, and an embed that names no destination field has
117		-	// nothing for it to read.
	113	+	// Six `without_` calls now. quasi 0.54.0 added the fill script, and
	114	+	// 0.59.0 and 0.60.0 added the reveal and repeat scripts. All three are
	115	+	// independent of htmx by design — what they read is attributes on a
	116	+	// control, a region or a fieldset — so dropping the transport does not
	117	+	// drop them, and each has to be refused by name. An embed names no
	118	+	// destination field, no conditional region and no repeating question,
	119	+	// so all three have nothing to read here.
118	120		.without_htmx()
119	121		.without_hyperscript()
120	122		.without_clock()
121	123		.without_fill()
	124	+	.without_reveal()
	125	+	.without_repeat()
122	126		.with_chrome(Chrome::new())
123	127		.with_head_first(head_first());
124	128		shell.body_class = body_class.map(str::to_owned);
			@@ -284,6 +288,8 @@
284	288		.without_hyperscript()
285	289		.without_clock()
286	290		.without_fill()
	291	+	.without_reveal()
	292	+	.without_repeat()
287	293		.with_chrome(Chrome::new())
288	294		.with_head_first(format!("{}<style>{PLAYER_CSS}</style>", head_first()));
289	295		shell.body_class = Some("embed-player".to_owned());