Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
gulp-sri-hash
Advanced tools
Gulp plugin for adding Sub-Resource-Integrity (SRI) hashes in-place to asset links found in HTML files.
Adds Subresource Integrity (SRI) hashes to HTML files.
It does so, by parsing the contents of passed in HTML files with cheerio, looking for <link rel=stylesheet href=URL>
and <script src=URL>
DOM-nodes, computing checksums for found referenced files, and adding integrity=<HASH>
attributes in-place to respective DOM-nodes.
Inspiration for this plugin came from working with static site generators.
For an alternative approach, have a look at the gulp-sri plugin.
Install package with NPM and add it to your development dependencies:
npm install gulp-sri-hash --save-dev
const sriHash = require('gulp-sri-hash');
gulp.task('sri', () => {
return gulp.src('./**/*.html')
// do not modify contents of any referenced css- and js-files after this task...
.pipe(sriHash())
// ... manipulating html files further, is perfectly fine
.pipe(gulp.dest('./dist/'));
});
This will look for css and js file references contained in all html-files, calculate SRI-hashes for those files, and add integrity=<HASH>
attributes for those references.
Referenced css- and js-files must be accessible from the local filesystem. In order to calculate correct hashes, style and script files should not be modified any further by build steps running later.
Line Endings:
Content hashing is sensitive to differences in line-endings. On Windows, the default is CRLF
, whereas (all?) other Operating Systems default to LF
.
You're good, as long the files use the same end-of-line sequence locally as well as on the server that delivers those asset files.
On the other hand, a change of line-endings after content hashing will cause a file checksum mismatch.
String
sha384
Select hashing algorithm. Supported algorithms: sha256
, sha384
, and sha512
.
String
''
Strips string from beginning of referenced URI in HTML files. Useful if references do not match directory structure or already contain CDN hostname.
String
link[href][rel=stylesheet]:not([integrity]), script[src]:not([integrity])
Only look for nodes matching this custom (jQuery-style) selector.
Boolean
false
Controls whether referenced files should be resolved relative to a base folder, or relative to the location of the HTML file.
Inspired by https://github.com/macedigital/gulp-sri-hash/pull/1.
Boolean
false
Controls whether to permit cached cheerio instances, e.g. when using gulp-cheerio in a previous build step. Be careful when enabling this feature as it can have unintended side-effects.
Following snippet shows all options in action:
// ...
.pipe(sriHash({
algo: 'sha512', // use strong hashing
prefix: '/assets', // no trailing slash
selector: 'link[href]', // limit selector
relative: true // assets reside relative to html file
}))
// ...
Since v2.0.0:
Require a peer-dependency of gulp 4.x and drop support for nodejs 4.x which reached its End-of-Life on April 30th 2018.
Since v1.4.0:
Querystring-like components in file paths are ignored when resolving local files. As an example, the given string /folder/style.css?v=somehash
will resolve to local file /folder/style.css
.
Since v1.3.0:
A crossorigin=anonymous
attribute will be added to all updated DOM nodes, unless the attribute has been already been set to value use-credentials
. In the latter case the crossorigin
attribute is left unchanged.
MIT License
FAQs
Gulp plugin for adding Sub-Resource-Integrity (SRI) hashes in-place to asset links found in HTML files.
The npm package gulp-sri-hash receives a total of 177 weekly downloads. As such, gulp-sri-hash popularity was classified as not popular.
We found that gulp-sri-hash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.