Skip to content

Conversation

davel
Copy link
Contributor

@davel davel commented Dec 28, 2021

Adds an integrity attribute so that we no longer blindly trust the CDN for pdfobject.min.js. crossorigin is now necessary for the resource to continue to load.

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Don't blindly trust free CDNs.
@HackbrettXXX
Copy link
Collaborator

Thanks for the PR. How did you create the hash? cdnjs usually creates sha512 hashs:

<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfobject/2.1.1/pdfobject.min.js" integrity="sha512-4ze/a9/4jqu+tX9dfOqJYSvyYd5M6qum/3HpCLr+/Jqf0whc37VUbkpNGHR7/8pSnCFw47T1fmIpwBV7UySh3g==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

@davel
Copy link
Contributor Author

davel commented Jan 19, 2022

Thanks for the PR. How did you create the hash? cdnjs usually creates sha512 hashs:

<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfobject/2.1.1/pdfobject.min.js" integrity="sha512-4ze/a9/4jqu+tX9dfOqJYSvyYd5M6qum/3HpCLr+/Jqf0whc37VUbkpNGHR7/8pSnCFw47T1fmIpwBV7UySh3g==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

I have upgraded the hash to sha512.

To generate the hash I followed the suggested commands on the Mozilla link. This should give you the same hash,

curl https://cdnjs.cloudflare.com/ajax/libs/pdfobject/2.1.1/pdfobject.min.js | openssl dgst -sha512 -binary | openssl base64 -A

Copy link
Collaborator

@HackbrettXXX HackbrettXXX left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, looks good. Thanks!

@HackbrettXXX HackbrettXXX merged commit a5f8fc9 into parallax:master Jan 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants