AdguardTeam / AdguardTeam/CoreLibs

Handle SRI integrity issues in JS APIs

未关闭
#1,562 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
Enhancement needs tech clarification Priority: P4
主要语言
没有语言数据
星标
52
派生
10
PR 合并指标
30 天内没有已合并 PR

描述

The issue has been originally raised here, but it's wider than that:
https://github.com/AdguardTeam/CoreLibs/issues/1539

In order to solve this, we need to override `window.fetch` and other functions that accept `integrity` so that we could override it:
https://developer.mozilla.org/en-US/docs/Web/API/Request/integrity

Note, that this is not limited just to web pages. We also need to handle service workers as well:
https://developers.google.com/web/tools/workbox/reference-docs/latest/module-workbox-precaching#.addRoute
https://developers.google.com/web/tools/workbox/reference-docs/latest/module-workbox-precaching#.precacheAndRoute

Patching JS apis on every website is quite dangerous so instead of that I suggest adding a scriptlet that would be able to either suppress integrity check or change it so that AG was doing it.

This also means that we need to have scriptlets that are injected into service workers.

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。