Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing subresource integrity checking for Font Awesome JS #1920

Closed
Kristaba opened this issue Oct 29, 2018 · 1 comment
Closed

Missing subresource integrity checking for Font Awesome JS #1920

Kristaba opened this issue Oct 29, 2018 · 1 comment
Labels
Status: Accepted Type: Enhancement

Comments

@Kristaba
Copy link
Contributor

It seems that the Font Awesome's javascript code is served by their CDN by default.
I am not too much used to web development, but I believe the subresource integrity checking should be used in such case.

minimal-mistakes/_includes/scripts.html

Line 12 in f4cfc87

<script src="https://use.fontawesome.com/releases/v5.3.1/js/all.js"></script>

The hash of each version of Font Awesome files is available in their website.
So the current line should be replaced by something like:

<script src="https://use.fontawesome.com/releases/v5.3.1/js/all.js" integrity="sha384-kW+oWsYx3YpxvjtZjFXqazFpA7UP/MbiY4jvs+RWZo2+N94PFZ36T6TFkc9O3qoB"></script>
@mmistakes
Copy link
Owner

Care to submit a pull request with the integrity value added?

@Kristaba Kristaba mentioned this issue Oct 30, 2018
Merged
okitem pushed a commit to okmalls/okmalls.github.io that referenced this issue Sep 21, 2024
@cotes2020
refactor(ui): standardize the border radius (mmistakes#1920)
31e19c6 
Impact:
- Increase the border radius of inline code and `<kbd>` tags
- Variable `$base-radius` renamed to `$radius-lg`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Status: Accepted Type: Enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Kristaba @mmistakes