Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

ember-cli-sri

Package Overview
Dependencies
Maintainers
1
Versions
24
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

ember-cli-sri

SRI generation for Ember CLI

  • 1.1.0
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
100K
increased by2.98%
Maintainers
1
Weekly downloads
 
Created
Source

Ember-cli-sri

build status npm status dependency status

What is it

This plugin is used to generate Subresource Integrity (SRI) hashes for ember applications. Subresource integrity is a security concept used to check JavaScript and stylesheets are loaded with the correct content when using a CDN.

Why

The reason to add this to your application is to protect against poisoned CDNs breaking JavaScript or CSS subresources.

Installation

  • ember install ember-cli-sri

Configure

In Brocfile.js or ember-cli-build.js:

var app = new EmberApp({
});
  • Without fingerprinting Ember will default to using relative URLs
  • All relative paths will be given an integrity attribute which will make compliant browsers check content matches

Or:

var app = new EmberApp({
  SRI: {
    crossorigin: 'anonymous'
  },
  fingerprint: {
    prepend: 'https://subdomain.cloudfront.net/'
  }
});
  • If your applications origin is different to where your subresources load from you will need to use CORS
  • Your subresources will need to be served with CORS headers
  • You will need to specify SRI.crossorigin

Or:

var app = new EmberApp({
  origin: 'https://subdomain.cloudfront.net/',
  fingerprint: {
    prepend: 'https://subdomain.cloudfront.net/'
  }
});
  • If you like absolute URLs in your HTML then let the addon know by specifying a origin attribute

Options

  • origin - set to the URL the Ember app is served from (Example: https://example.com)
  • SRI
    • crossorigin - adds a crossorigin attribute to script and link elements
      • This is required for CORS resources, values are:
        • use-credentials
        • anonymous
    • runsIn - default: ['production', 'test']
    • enabled - default: true
    • paranoiaCheck - default: true
  • fingerprint
    • prepend - resources with a full path will only get an applied integrity if the md5 checksum passes

Example output

<script src="https://example.com/thing-5e1978f9cfa158d9841d7b6d8a4e5c57.js" integrity="sha256-oFeuE/P+XJMjkMS5pAPudQOMGJQ323nQt+DQ+9zbdAg= sha512-+EXjzt0I7g6BjvqqjkkboGyRlFSfIuyzY2SQ43HQKZBrHsjmRzEdjSHhiDzVs30nXL9H0tKw6WbMPc6RfzUumQ==" crossorigin="anonymous" /></script>
<script src="https://example.com/thing-5e1978f9cfa158d9841d7b6d8a4e5c57.js" crossorigin="use-credentials"  integrity="sha256-oFeuE/P+XJMjkMS5pAPudQOMGJQ323nQt+DQ+9zbdAg= sha512-+EXjzt0I7g6BjvqqjkkboGyRlFSfIuyzY2SQ43HQKZBrHsjmRzEdjSHhiDzVs30nXL9H0tKw6WbMPc6RfzUumQ=="/></script>
<script src="unicode-chars.js" integrity="sha256-TH5eRuwfOSKZE0EKVF4WZ6gVQ/zUch4CZE2knqpS4MU= sha512-eANuTl8NOQEa4/zm44zxX6g7ffwf6NXftA2sv4ZiQURnJsfJkUnYP8XpN2XVVZee4SjB32i28WM6trs9HVgQmA=="/></script>

Fail safe

This addon should fail safely at all times so resources matching https? need:

  • Asset URL needs to start with fingerprint.prepend
  • Asset must use fingerprinting with md5
  • Asset must match md5 sum to what is in the filesystem
  • An SRI.crossorigin attribute must be set or a matching origin to fingerprint.prepend

If the config is not set correctly it should result in just a lack of SRI protection, which is better than a broken website.

Please file bugs if you find a case when the config doesn't 'fail safe', is not clear or results in a broken page.

Gotchas

  • If your Ember application is NOT being loaded on the same origin as in fingerprint.prepend:

    • The fingerprint.prepend domain will need to be serving CORS Headers
  • If your Ember application is being loaded on the same origin as in fingerprint.prepend:

    • Setting the crossorigin attribute isn't advised unless origin is serving CORS Headers
  • In code that uses SRI, you MUST NOT tamper with the built output JavaScript files as code will not load.

Crossorigin attribute

When the request doesn't match Same Origin Policy the crossorigin attribute MUST be present for the integrity of the file to be checked. With an integrity set on an external origin and a missing crossorigin the browser will choose to 'fail-open' which means it will load the resource as if the integrity attribute was not set.

Values:

  • anonymous - A cross-origin request (i.e., with Origin: HTTP header) is performed. But no credentials are sent (i.e., no cookie, no X.509 certificate, and no HTTP Basic authentication is sent). If the server does not give credentials to the origin site (by not setting the Access-Control-Allow-Origin: HTTP header), the resource will be tainted and its usage restricted.
  • use-credentials - A cross-origin request (i.e., with Origin: HTTP header) performed with credentials (i.e., a cookie, a certificate, and HTTP Basic authentication is performed). If the server does not give credentials to the origin site (through Access-Control-Allow-Credentials: HTTP header), the resource will be tainted and its usage restricted.

'Fail-open' vs 'Fail-close'

  • The current implementation in Chrome 'fails-open' resources that don't set the correct crossorigin attribute, this will be changed to 'fail-close' which is simpler to debug.
  • Browsers will still however 'fail-open' on cross origin resources that don't match the integrity attribute but don't send the correct CORS headers.
    • This is because an attacker could check the integrity of authenticated only files or files behind a firewall.
  • Browsers that don't support integrity checking will fail-open so it is a safe property to use if configured correctly.

'paranoiaCheck'

This addon will always take the default pain free stance; so this has been enabled by default until the issue is resolved.

Currently there is an encoding issue based on certain characters which is still being debugged when using Chrome. This check fails if there is any non ASCII characters. On failure the file won't have a integrity attribute added. Please note this will be removed as a default in the future; with the desire to remove all of the checking code too.

Browser support

  • Chrome 45
  • Firefox stable 42

Notes:

  • Please verify Ember applications in supporting browsers, paying close attention to console messages
  • No known formal objections to the specification

Running Tests

  • npm test

Keywords

FAQs

Package last updated on 03 Sep 2015

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc