8000 feature #53251 [AssetMapper] Add integrity hash to the default es-mod… · symfony/symfony@922d21c · GitHub
[go: up one dir, main page]
Skip to content

Commit 922d21c

Browse files
fabpotfabpot
committed
feature #53251 [AssetMapper] Add integrity hash to the default es-module-shims script (smnandre)
This PR was squashed before being merged into the 7.1 branch. Discussion ---------- [AssetMapper] Add integrity hash to the default es-module-shims script | Q | A | ------------- | --- | Branch? | 7.1 | Bug fix? | no | New feature? | yes | Deprecations? | no | Issues | Fix #52939 (partially) | License | MIT We'll need some deeper changes to manage integrity hashes with custom polyfill URL's... But this PR already handles the "standard" way of using es-module-shims. Commits ------- 903259c [AssetMapper] Add integrity hash to the default es-module-shims script
2 parents 8901f11 + 903259c commit 922d21c

File tree

2 files changed

+20
-8
lines changed

2 files changed

+20
-8
lines changed

‎src/Symfony/Component/AssetMapper/ImportMap/ImportMapRenderer.php

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,9 @@
2727
*/
2828
class ImportMapRenderer
2929
{
30-
private const DEFAULT_ES_MODULE_SHIMS_POLYFILL_URL = 'https://ga.jspm.io/npm:es-module-shims@1.8.0/dist/es-module-shims.js';
30+
// https://generator.jspm.io/#S2NnYGAIzSvJLMlJTWEAAMYOgCAOAA
31+
private const DEFAULT_ES_MODULE_SHIMS_POLYFILL_URL = 'https://ga.jspm.io/npm:es-module-shims@1.8.2/dist/es-module-shims.js';
32+
private const DEFAULT_ES_MODULE_SHIMS_POLYFILL_INTEGRITY = 'sha384-+dzlBT6NPToF0UZu7ZUA6ehxHY8h/TxJOZxzNXKhFD+5He5Hbex+0AIOiSsEaokw';
3133

3234
public function __construct(
3335
private readonly ImportMapGenerator $importMapGenerator,
@@ -47,7 +49,7 @@ public function render(string|array $entryPoint, array $attributes = []): string
4749
$importMap = [];
4850
$modulePreloads = [];
4951
$cssLinks = [];
50-
$polyFillPath = null;
52+
$polyfillPath = null;
5153
foreach ($importMapData as $importName => $data) {
5254
$path = $data['path'];
5355

@@ -58,7 +60,7 @@ public function render(string|array $entryPoint, array $attributes = []): string
5860

5961
// if this represents the polyfill, hide it from the import map
6062
if ($importName === $this->polyfillImportName) {
61-
$polyFillPath = $path;
63+
$polyfillPath = $path;
6264
continue;
6365
}
6466

@@ -102,22 +104,31 @@ public function render(string|array $entryPoint, array $attributes = []): string
102104
</script>
103105
HTML;
104106

105-
if (false !== $this->polyfillImportName && null === $polyFillPath) {
107+
if (false !== $this->polyfillImportName && null === $polyfillPath) {
106108
if ('es-module-shims' !== $this->polyfillImportName) {
107109
throw new \InvalidArgumentException(sprintf('The JavaScript module polyfill was not found in your import map. Either disable the polyfill or run "php bin/console importmap:require "%s"" to install it.', $this->polyfillImportName));
108110
}
109111

110112
// a fallback for the default polyfill in case it's not in the importmap
111-
$polyFillPath = self::DEFAULT_ES_MODULE_SHIMS_POLYFILL_URL;
113+
$polyfillPath = self::DEFAULT_ES_MODULE_SHIMS_POLYFILL_URL;
112114
}
113115

114-
if ($polyFillPath) {
115-
$url = $this->escapeAttributeValue($polyFillPath);
116+
if ($polyfillPath) {
117+
$url = $this->escapeAttributeValue($polyfillPath);
118+
$polyfillAttributes = $scriptAttributes;
119+
120+
// Add security attributes for the default polyfill hosted on jspm.io
121+
if (self::DEFAULT_ES_MODULE_SHIMS_POLYFILL_URL === $polyfillPath) {
122+
$polyfillAttributes = $this->createAttributesString([
123+
'crossorigin' => 'anonymous',
124+
'integrity' => self::DEFAULT_ES_MODULE_SHIMS_POLYFILL_INTEGRITY,
125+
] + $attributes);
126+
}
116127

117128
$output .= <<<HTML
118129
119130
<!-- ES Module Shims: Import maps polyfill for modules browsers without import maps support -->
120-
<script async src="$url"$scriptAttributes></script>
131+
<script async src="$url"$polyfillAttributes></script>
121132
HTML;
122133
}
123134

‎src/Symfony/Component/AssetMapper/Tests/ImportMap/ImportMapRendererTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ public function testDefaultPolyfillUsedIfNotInImportmap()
121121
);
122122
$html = $renderer->render(['app']);
123123
$this->assertStringContainsString('<script async src="https://ga.jspm.io/npm:es-module-shims@', $html);
124+
$this->assertStringContainsString('es-module-shims.js" crossorigin="anonymous" integrity="sha384-', $html);
124125
}
125126

126127
public function testCustomScriptAttributes()

0 commit comments

Comments
 (0)
0