2

Background

A discussion about not sourcing JavaScript files from other websites (http://www.reddit.com/r/netsec/comments/29hfhz/please_dont_use_externally_hosted_javascript/) got me thinking.

Performance and cost reasons are mentioned that might make sense to have some scripts hosted by 3rd parties.

Question

Is there an existing way to check referenced JavaScript (or maybe even images, other data) has not been changed by malicious actor?

From the top of my head, I'd say you might be able to do that with websockets to download the script and then check its hash, insert into HTML. Maybe. I do not recall any built-in solutions, like maybe <script src="https://foo/bar.js" hash="$5$0xf00...$0xbaa..."></script>.

4
  • Do you mean like a spoofed domain, or an untrusted domain? Jul 1, 2014 at 16:33
  • No, I mean something like apis.google.com being compromised.
    – domen
    Jul 1, 2014 at 16:36
  • Oh, well you could reverse proxy it from mysite.com/googleapi/, but at that point you aren't saving on bandwidth. More importantly though, that api link is blocked from the network I am currently on. So if you want to guarantee all of your content is accessible, have it all at least appear to be hosted from your domain. Jul 1, 2014 at 17:01
  • I understand this doesn't answer your question on how to hash a js file. 1) I don't know and 2) I wouldn't do it even if I knew how. Jul 1, 2014 at 17:02

1 Answer 1

1

There are no built-in solutions. (But there certainly should be!) You can indeed download the data using XMLHttpRequest 2 and then verify its hash using a JavaScript SHA-256 implementation before doing something with the result (e.g. evaling it, if it is JavaScript code). This will only work if the untrusted server supports CORS. The browser cache of the resource can still be used.

1
  • At which point, just host it yourself. Jul 1, 2014 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .