broccoli-sri-hash

SRI for broccoli

This plugin looks at an apps html files to rewrite their content with integrity attributes.

Options

• origin - if crossorigin isn't specified but prepend is it will add an integrity if prepend starts with origin
• crossorigin - adds a crossorigin attribute to script and link elements
  • This is required for CORS resources values are:
    • use-credentials
    • anonymous
• prepend - resources with a full path will only get an applied integrity if the md5 checksum passes
• paranoiaCheck - false by default, this turns off the integrity attribute if any Unicode is found within the file.

Example

var sriTree = sri('path/to/code', {
  prefix: 'https://example.com/',
  crossorigin: 'anonymous'
});

'paranoiaCheck'

There was an encoding issue based on certain characters which is landed in Chrome 46 when using Chrome. This check fails if there is any non ASCII characters. On failure the file won't have a integrity attribute added. Please note this will be removed as a default in the future; with the desire to remove all of the checking code too.