Implementing Subresource Integrity (#1729)

* Add sprockets-rails to Gemfile

* Add sprockets-rails to Gemfile.lock

* Update show.html.haml

* Update index.html.haml

* Update admin.html.haml

* Update auth.html.haml

* Update embedded.html.haml

* Update public.html.haml

diff --git a/Gemfile b/Gemfile
index 9a1792623b572ea2bdeb8a99496499fe96c6814b..a1313f6170763ea20c7b9b870e4d6ff960f75b20 100644 (file)
--- a/Gemfile
+++ b/Gemfile
@@ -50,6 +50,7 @@ gem 'sidekiq'
 gem 'sidekiq-unique-jobs'
 gem 'simple-navigation'
 gem 'simple_form'
+gem 'sprockets-rails', :require => 'sprockets/railtie'
 gem 'statsd-instrument'
 gem 'twitter-text'
 gem 'tzinfo-data'

diff --git a/Gemfile.lock b/Gemfile.lock
index f1bc9880ecb5f112abed9dc190ca983aa11014c2..c7ea894dcce12104fc0a4b9a72eaacff8be75e5c 100644 (file)
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -520,6 +520,7 @@ DEPENDENCIES
   simple-navigation
   simple_form
   simplecov
+  sprockets-rails
   statsd-instrument
   twitter-text
   tzinfo-data

diff --git a/app/views/about/show.html.haml b/app/views/about/show.html.haml
index 0c066962d6b60b04f178b010dbd1539efaa927dd..922e42575f9f1341810388f7d0f5829f643c984d 100644 (file)
--- a/app/views/about/show.html.haml
+++ b/app/views/about/show.html.haml
@@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true
 
 - content_for :page_title do
   = Rails.configuration.x.local_domain

diff --git a/app/views/home/index.html.haml b/app/views/home/index.html.haml
index 9e3b9446335813d016d32fa20deecad5f2e9410f..6cb7155767c3d2c55844a9e73708ffb0e6adc052 100644 (file)
--- a/app/views/home/index.html.haml
+++ b/app/views/home/index.html.haml
@@ -3,6 +3,6 @@
     window.STREAMING_API_BASE_URL = '#{Rails.configuration.x.streaming_api_base_url}';
     window.INITIAL_STATE = #{json_escape(render(file: 'home/initial_state', formats: :json))}
 
-  = javascript_include_tag 'application'
+  = javascript_include_tag 'application', integrity: true
 
 = react_component 'Mastodon', default_props, class: 'app-holder', prerender: false

diff --git a/app/views/layouts/admin.html.haml b/app/views/layouts/admin.html.haml
index 59fe078dfc6e1b67fff83eef273a33582fd28283..fa364750f98d27c7dc8967a12c435547900f31f1 100644 (file)
--- a/app/views/layouts/admin.html.haml
+++ b/app/views/layouts/admin.html.haml
@@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true
 
 - content_for :content do
   .admin-wrapper

diff --git a/app/views/layouts/auth.html.haml b/app/views/layouts/auth.html.haml
index db841d27a7ae52e5133e52da06c60cd22f10acfb..bf4113baf23af718c365f5d1c79b6f72d6e696aa 100644 (file)
--- a/app/views/layouts/auth.html.haml
+++ b/app/views/layouts/auth.html.haml
@@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true
 
 - content_for :content do
   .container

diff --git a/app/views/layouts/embedded.html.haml b/app/views/layouts/embedded.html.haml
index adbf0a28707e7019f839f8be48ec691698ee538a..c34247c913270f791bf05e8b57aaa18318b488ca 100644 (file)
--- a/app/views/layouts/embedded.html.haml
+++ b/app/views/layouts/embedded.html.haml
@@ -3,6 +3,6 @@
   %head
     %meta{:charset => 'utf-8'}/
     = stylesheet_link_tag 'application', media: 'all'
-    = javascript_include_tag 'application_public'
+    = javascript_include_tag 'application_public', integrity: true
   %body.embed
     = yield

diff --git a/app/views/layouts/public.html.haml b/app/views/layouts/public.html.haml
index 808fb0a0e6e445a4fcff5bd8a30e8f47359351f8..56781a286e523a53a7670c7c7be877a24518e7e7 100644 (file)
--- a/app/views/layouts/public.html.haml
+++ b/app/views/layouts/public.html.haml
@@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true
 
 - content_for :content do
   .container= yield