2 ms·
You would still have to combine SRI with a fairly strong CSP to avoid any code execution except SRI-covered stuff. It would be a good PoC I guess, but not prac
by the8472 7y ago
You would still have to combine SRI with a fairly strong CSP to avoid any code execution except SRI-covered stuff.
It would be a good PoC I guess, but not practical yet for most people.
- e12e 7y agoWe're talking about a html file that's basically: <html> <script src=example.cdn/app.js (SRI hash) /> </html> If your app.js go including unknown fonts and js etc... Then, yeah, you've got problems.
- AgentME 7y agoCSP would only be necessary if the SRI-covered stuff had bugs that let it accidentally load unverified resources. (To be clear, I think CSP is a necessary defense-in-depth measure for everyone, but this case doesn't uniquely require it.)