Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JS import integrity check #89

Closed
marcusbooyah opened this issue Mar 6, 2024 · 1 comment
Closed

JS import integrity check #89

marcusbooyah opened this issue Mar 6, 2024 · 1 comment

Comments

@marcusbooyah
Copy link
Member

marcusbooyah commented Mar 6, 2024

We recently had an issue at InStep where a CDN was not working properly, and we were only getting half of a JS file.

It would be great to have an API that can import a JS module while also checking the integrity.

This works:

const request = new Request("https://cdn.bootcdn.net/ajax/libs/echarts/5.5.0/echarts.min.js", {
  integrity: "sha256-QvgynZibb2U53SsVu98NggJXYqwRL7tg3FeyfXvPOUY=",
});
const response = await fetch(request);

This throws an exception:

const request = new Request("https://cdn.bootcdn.net/ajax/libs/echarts/5.5.0/echarts.min.js", {
  integrity: "sha256-foobar",
});
const response = await fetch(request);

Something like the following would be great:

IJSObjectReference module = await JS.ImportModuleAsync(
	src:       "https://cdn.bootcdn.net/ajax/libs/echarts/5.5.0/echarts.min.js",
	integrity: "sha256-QvgynZibb2U53SsVu98NggJXYqwRL7tg3FeyfXvPOUY=");

IJSObjectReference module = await JS.ImportModuleAsync(
	src:       "https://cdn.bootcdn.net/ajax/libs/echarts/5.5.0/echarts.min.js",
	integrity: "sha256-QvgynZibb2U53SsVu98NggJXYqwRL7tg3FeyfXvPOUY=",
    fallback: "./_content/MyPackage/echarts.min.js");

The second option here first checks the CDN, and falls back the local version if there are any issues loading the script from the CDN.

@marcusbooyah
Copy link
Member Author

@caroHagg did this and it's merged now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant