[AssetMapper] Add integrity metadata to importmaps #60378
Conversation
37d5d36 to
4648474
Compare
|
If you want to check, started some work was done here #58722 (and was waiting for people to step in and help, so really glad you did here 👍 ) |
| @@ -25,6 +26,7 @@ class MappedAssetFactory implements MappedAssetFactoryInterface | ||
| { | ||
| private const PREDIGESTED_REGEX = '/-([0-9a-zA-Z]{7,128}\.digested)/'; | ||
| private const PUBLIC_DIGEST_LENGTH = 7; | ||
| private const INTEGRITY_HASH_ALGORITHMS = ['sha256', 'sha384', 'sha512']; |
There was a problem hiding this comment.
Do we really need multiple algorithms ?
There was a problem hiding this comment.
I think so: it’s required to support https://w3c.github.io/webappsec-subresource-integrity/#agility, and people apparently don’t agree on what the default algorithm should be.
| ->info('Array of algorithms used to compute importmap resources integrity.') | ||
| ->beforeNormalization()->castToArray()->end() | ||
| ->prototype('scalar')->end() | ||
| ->defaultValue(['sha384']) |
There was a problem hiding this comment.
| ->defaultValue(['sha384']) | |
| ->defaultNull() |
This would be a BC break imho.
But it will also slow down the build time / memory usage.. so I do not think this is something that should be enabled per default (like cors)
There was a problem hiding this comment.
Makes sense; guess the recipe would be a good place to put this default then?
Takes over #58722 because I missed it existed..!