Javascript on Wilhelm Maritz

The date that was yesterday until 3am

Fri, 11 Sep 2026 00:00:00 +0000

This line looks harmless:

const today = new Date().toISOString().slice(0, 10);

toISOString() gives the UTC date. I live in UTC+3, so from midnight until 03:00 every night that line names yesterday, and on the first of a month it names the previous month.

An app I maintain did it in three places: the today marker on a calendar, and a gate on the admin page that decides whether the month you’re editing is already in the past, twice. Nobody had noticed, because nobody uses a rostering app at 2am. Except the schedulers, who work nights. It surfaced in the review of the change that moved the app’s scripts out of its templates, as an old bug in code that change had only relocated.

Enforcing a Content-Security-Policy without nonces

Thu, 10 Sep 2026 00:00:00 +0000

An app I maintain kept its JavaScript inline. The main page’s template was 3,979 lines, and 3,528 of them were one <script> block. Eight other pages were the same shape, around 6,500 lines in all.

That rules out a strict Content-Security-Policy. A policy that blocks injected scripts has to drop 'unsafe-inline' from script-src, and then every one of those blocks stops running. The usual answer is a nonce per request on every script tag. I didn’t build that.

Safari could not download the file

Wed, 02 Sep 2026 00:00:00 +0000

A Mac user clicked Export in an app I maintain and got this instead of a spreadsheet:

WebKitBlobResource error 1

The pattern that broke

The download code was the pattern you find everywhere: fetch the file, turn it into a blob, point an invisible link at it, click the link, tidy up. In outline:

async function download(url, name) {
 const res = await fetch(url);
 const blob = await res.blob();
 const a = document.createElement("a");
 a.href = URL.createObjectURL(blob);
 a.download = name;
 a.click();
 URL.revokeObjectURL(a.href);
}

The app had four hand-rolled copies of it.