Subresource Integrity

[Gargron]

Sprockets supported subresource integrity out of the box. It would be nice if

javascript_pack_tag 'vendor', integrity: true, crossorigin: 'anonymous'

worked the same. There is a webpack plugin but I am not sure how to hook it up to Rails to put the integrity hashes into the template.

[gauravtiwari]

@Gargron Will take a look at this 👍

[Miaourt]

Any new on this ? ^-^

[dhh]

This ticket is three days old. Gaurav is doing an excellent job investigating the many requests put forward here, but let's not burn him out with incessant pestering on issues that were just opened but have not yet progressed. If you want to contribute a PR with a proposed solution, that's awesome. But otherwise please have some patience. Thanks!

…

On Sun, May 7, 2017 at 5:01 PM, Technowix ***@***.***> wrote: Any new on this ? ^-^ — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#323 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAKtdEzZp6Tj5JWYawOuFWtnAH92CFQks5r3dzhgaJpZM4NQFuj> .

[gauravtiwari]

Just to update everyone here, this feature is on hold for now as I couldn't find any straightforward solution to this problem (something that doesn't make things complicated).

Feel free to leave any suggestions/ideas here though 👍

[renchap]

I just looked at my production Sprockets manifest and I can see that it contains the SRI digest for my packs:

{
  "files": {
    "manifest-d0ff5974b6aa52cf562bea5921840c032a860a91a3512f7fe8f768f6bbe005f6.js": {
      "logical_path": "manifest.js",
      "mtime": "2017-03-23T17:25:57+00:00",
      "size": 0,
      "digest": "d0ff5974b6aa52cf562bea5921840c032a860a91a3512f7fe8f768f6bbe005f6",
      "integrity": "sha256-0P9ZdLaqUs9WK+pZIYQMAyqGCpGjUS9/6Pdo9rvgBfY="
    },
}

I know that Webpacker does not depend on Sprockets, but this seems the way to go. I am not sure why this is generated, but I think we should use the same mechanism: put the SRI digests (and in the future other informations?) in the manifest generated by Webpack.

The current webpack-manifest-plugin has a different format which does not allow other informations than the full path, but I dont think it would be hard to fork it and improve the manifest format, or output another manifest.

Some Webpack plugins already store the SRI attributes in Webpack'sstats object:
https://github.com/mikechau/sri-stats-webpack-plugin
https://github.com/waysact/webpack-subresource-integrity

I wont have time to work on this, but hopefully here are some ideas!

[renchap]

A new reduce option has been added to webpack-manifest-plugin.
This allows to customize the manifest, for example to include the SRI hash: shellscape/webpack-manifest-plugin#35 (comment)

Webpacker could ship with a webpack-manifest-plugin configuration that adds the needed attributes to the manifest, and then pass them to javascript_include_tag and stylesheet_pack_tag.

[mvastola]

I would like to +1 @renchap's suggestion to use the new feature of webpack-manifest-plugin to generate multi-dimensional hashes in manifest.json. This approach strikes me as highly robust, with use cases extending beyond SRI hashes.

With a simple change of the structure of manifest.json from:

{
  "application.js": "/packs/application-[DIGEST].js"
}

.. to:

{
  "application.js": {
    "path": "/packs/application-[DIGEST].js"
  }
}

.. it immediately becomes possible to add all kinds of metadata into the manifest that could be appended by webpack plugins and then accessed through a universal interface provided by helpers.

Integrity hashes is just one piece of data that could be passed in here. Other data that comes to mind includes:

• Image metadata -- sizes could be automagically determined when using image_tag and even the alt attribute could gathered EXIF data.
• Dependencies -- so that, for instance, when I call *_pack_tag any images/etc the stylesheet/javascript depends on can be optionally prefectched with <link rel="preload" href="[FOO]" as="[BAR]"> tags being inserted alongside the stylesheet/javascript include.

I can probably think of more, (and I'm sure there are many custom situations) but you get the jist.

[mvastola]

@gauravtiwari what are your thoughts on my comment above? I might be interested in making a PR (at least to preliminarily change the format of manifest.json and changing the ruby library to parse the different manifest format, but I don't want to step on your toes, nor do I don't want to submit a PR if it is going to be viewed as "too complicated".

[renchap]

Bump here. I think this would be awesome to first use the new structure for the manifest file, and then add others features based on it, starting with SRI :)
This does not look like a big change.

[renchap]

The new manifest plugin used in Webpacker 4 (https://github.com/webdeveric/webpack-assets-manifest) supports an integrity option. This adds all the needed hashes to the manifest, which can then be passed to the *_tag Rails helpers.

[gauravtiwari]

Yep, that's why used it so we can get this feature too at some point. Initially, I added the option but then it changes the manifest schema, which means rethinking the way the manifest class is structured in the gem and it's responsibilities (integration with the helper module) so this feature is slightly more involved.

[mvastola]

@gauravtiwari, would a PR be accepted that implements this feature? Or does more discussion need to take place first (regarding the helper module, etc -- perhaps with the Rails team)? If the latter, where would be the best place to start it?