3 ms·
Doesn't the resource still need to be requested to perform the integrity check? If I recall correctly the script was being redirected to a github gist which is
by taf2 9y ago
Doesn't the resource still need to be requested to perform the integrity check? If I recall correctly the script was being redirected to a github gist which is why it was effectively a DDOS on github... so yes sub-resource integrity is great but wouldn't protect against this type of attack since the requester was the target of the attack but rather the source...
- JohnTHaller 9y agoThis particular attack had China inserting a javascript reloader into Baidu's javascript file to hit the two github projects they didn't like to perpetrate the DDoS. So, it wasn't just a redirect.