1

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?

For example, if a .js file is pulled in by the main web page and it includes reference to a further .js file, the top level file's hash won't change if the URL of the further .js file doesn't change but the code at that URL has. So the top level file will pass its SRI check even though that script is then pulling in an unchecked script.

Or does CSP 'require-sri-for' checking get inherited by the scripts that are then loaded and so own down the import chain (if there is one)?

  • On a side note, I would recommend against the quite experimental require-sri-for and instead opt for the better supported strict-dynamic, which is designed to propagate trust. – MechMK1 May 16 '19 at 10:17
1

No, it does not mean that. This header tells the browser to enforce SRI check on every single script you have on the page.

If you use:

Content-Security-Policy: require-sri-for script

You must add the integrity attribute of every script you use:

<script src="https://some.code.com/example1.js"
    integrity="sha256-5i/mQ...yXWA="></script>

<script src="https://some.code.com/example2.js"></script>

So if you don't use integrity attribute on any script, it won't load. So example2.js above will not be loaded.

  • I understand that (although thanks for your answer). What I'm asking about is what if a script is loaded that has the integrity attribute, but that script pulls in another script. Is that latter script included in the check for the integrity attribute e.g. 'example1.js' pulls in another script 'example3.js'? – David Scholefield May 16 '19 at 10:18
  • I don't think you can include a script on another script. You can use AJAX to retrieve a script and manipulate the DOM to include it, but this does not change the first script, so SRI only applies to the first, not to anything you load later. – ThoriumBR May 16 '19 at 10:32
  • Here is an interesting snippet which (I assume) is dynamically creating a script tag in the DOM? i = function(e, t) { e.find("script").remove(); var n = document.createElement("script"); n.src = "https://<some URL>", n.type = "text/javascript", n.setAttribute("async", ""), n.setAttribute("defer", ""), e.append(n) }, – David Scholefield May 16 '19 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.