AdguardTeam / AdguardTeam/CoreLibs

Handle SRI integrity issues in JS APIs

Offen
#1,562 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Enhancement needs tech clarification Priority: P4
Vorherrschende Sprache
Keine Sprachdaten
Sterne
52
Forks
10
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

The issue has been originally raised here, but it's wider than that:
https://github.com/AdguardTeam/CoreLibs/issues/1539

In order to solve this, we need to override `window.fetch` and other functions that accept `integrity` so that we could override it:
https://developer.mozilla.org/en-US/docs/Web/API/Request/integrity

Note, that this is not limited just to web pages. We also need to handle service workers as well:
https://developers.google.com/web/tools/workbox/reference-docs/latest/module-workbox-precaching#.addRoute
https://developers.google.com/web/tools/workbox/reference-docs/latest/module-workbox-precaching#.precacheAndRoute

Patching JS apis on every website is quite dangerous so instead of that I suggest adding a scriptlet that would be able to either suppress integrity check or change it so that AG was doing it.

This also means that we need to have scriptlets that are injected into service workers.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.