content/static: strip known utm sources on page load

Requests originating from gopls and redirected from godoc.org have a
"utm_source=gopls" and "utm_source=godoc" query param in the URL,
respectively.

If we see this, we will strip the query param on page load, so that so
that it doesn’t remain in all our URLs coming from these sites.

This is done to page load so that requests are still sent to GA with
these utm_sources intact.

For golang/go#42602

Change-Id: I63defcb50ba54b1e476de0f0db63c23494000046
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/270800
Trust: Julie Qiu <julie@golang.org>
Run-TryBot: Julie Qiu <julie@golang.org>
TryBot-Result: kokoro <noreply+kokoro@google.com>
Reviewed-by: Jamal Carvalho <jamal@golang.org>

content/static/html/base.tmpl

@@ -196,6 +196,14 @@
   }
   loadScript('/static/js/web-vitals.js', {type: 'module', defer: true});
   loadScript("/static/js/base.min.js");
+
+  if (document.querySelector('.js-gtmID').dataset.gtmid && window.dataLayer) {
+    window.dataLayer.push(function() {
+      loadScript('/static/js/utm_source.js', {type: 'module', async: true, defer: true})
+    })
+  } else {
+    loadScript('/static/js/utm_source.js', {type: 'module', async: true, defer: true})
+  }
 </script>
 
 {{block "post_content" .}}{{end}}

content/static/html/pages/unit.tmpl

@@ -26,4 +26,4 @@
     loadScript('/static/js/unit_fixed_header.js', {type: 'module', async: true, defer: true})
   </script>
   {{block "unit_post_content" .}}{{end}}
-{{end}}
+{{end}}

content/static/js/utm_source.js

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2019-2020 The Go Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style
+ * license that can be found in the LICENSE file.
+ */
+
+/**
+ * removeUTMSource removes the utm_source GET parameter if present.
+ * This is done using JavaScript, so that the utm_source is still
+ * captured by Google Analytics.
+ */
+window.onload = event => {
+  var urlParams = new URLSearchParams(window.location.search);
+  var utmSource = urlParams.get('utm_source');
+  if (utmSource !== 'gopls' && utmSource !== 'godoc') {
+    return;
+  }
+
+  /** Strip the utm_source query parameter and replace the URL. **/
+  var newURL = new URL(window.location.href);
+  urlParams.delete('utm_source');
+  newURL.search = urlParams.toString();
+  window.history.replaceState(null, '', newURL.toString());
+};

internal/middleware/secureheaders.go

@@ -13,8 +13,8 @@ import (
 var scriptHashes = []string{
 	// From content/static/html/base.tmpl
 	"'sha256-CgM7SjnSbDyuIteS+D1CQuSnzyKwL0qtXLU6ZW2hB+g='",
-	"'sha256-LIQd8c4GSueKwR3q2fz3AB92cOdy2Ld7ox8pfvMPHns='",
 	"'sha256-dwce5DnVX7uk6fdvvNxQyLTH/cJrTMDK6zzrdKwdwcg='",
+	"'sha256-Q0lBU5W61U2Bjmznl8iFgTCLw4PWCtS1taSwwNz3iGk='",
 	// From content/static/html/pages/badge.tmpl
 	"'sha256-T7xOt6cgLji3rhOWyKK7t5XKv8+LASQwOnHiHHy8Kwk='",
 	// From content/static/html/pages/fetch.tmpl