stotov / sri-checker

NodeJS Subresource Integrity checker

SRI-Checker

An easy to use module to check the subresource integrity status of a given URL.

Related Projects

Internet.nl

https://github.com/internetstandards/Internet.nl

Mozzilla Observatory website

https://github.com/mozilla/http-observatory-website/

sri-checker's Issues

Add a link to internet.nl's repo

@StotoV you've said you've found internet.nl's repository.

Could we add the repo link here for posterity? We could also add it (and a link to Mozilla Observatory) under a section in the README.md;, e.g.: Related Projects.

Thank you.

Add visual debug to code

See https://github.com/duckduckgo/tracker-radar-collector/blob/c44275829ec55e4a5f4e3bbedc7959171823097b/crawler.js#L28

Add labeler function

This function will output all relevant properties of a collected tag

Implement CLI

SRICollector erroring out

How to reproduce:
mkdir -p ./output
echo 'https://www.huizen.nl/' >> ./output/targetList.txt
npm start -- list -i './output/targetlist.txt' -o './output'

We get the following error:

2022-01-20T10:11:18.145Z [verbose]: [Scraper][0] getting SRITag data failed

Where interacting with the CDP session fails the collection

Add multiprocessing to the module

Add code coverage to CI/CD

• Add tool to check coverage
• Integrate tool in CI/CD
• Add badge to README

Add page load strategy to scraper

Puppeteer networkidle2 for instance. Also include test for this.

Replace 127.0.0.1 with localtest.me

For bringing the tests closer to reality

Implement one sanity test using the W3C test suite

https://w3c-test.org/subresource-integrity/subresource-integrity.html

This also relates to #20 and could be combined

Update README with how to get started

Section on using it via the CLI and a section on using it as a module

Add check for tag existence

Bol.com home page check if hashes show up

They are dynamically inserted

Save all logs that are not linked to a tag

Only logs that relate to SRI

Add check for tag validity

Test case in the scraper using https

Remove the hardcoded Chromium path

I agree with the comment here that we should possibly comment out this line:

sri-checker/src/scrape.js

Line 119 in 39d1282

executablePath: '/usr/bin/chromium' // To be removed if at all possible

On my system, the crawler works only if I comment out the line, because there's no chromium instance on /usr/bin/chromium (it's under one of the snap folders). Thus, I get the following:

2022-01-20T11:37:13.534Z [error]: [Scraper][0] https://www.huizen.nl/ Error: Failed to launch the browser process! spawn /usr/bin/chromium ENOENT

I comment the line, and everything works well.

I believe puppeteer node package already installs a Chromium instance that it then uses under the hood.

Add input validation for exposed functions in module

Add linter to CI/CD

• Install JS linter
• Integrate linter with CI/CD
• Add linter badge to README

Add check for fallover possibilities

When a hash does not match there is the option for a fallover. Check if this is implemented.

Add improved logging to CLI

Some progress bars would be nice for longer runs. This code should not clutter the module itself however, as it can also be used as non-cli application.

Add labeler output assert to scraper test suite

Add tests for dynamically injected script tags

Scripts may dynamically inject iframes, which may contain script tags that may fail the SRI check. The main advantage of using a JS-enabled browser such as Puppeteer (over e.g., a requests-based solution) is the ability to validate such dynamically added iframes/script tags.

Let's make sure to add a test case to demonstrate this difference.

We'd just need to inject an iframe containing some third-party script tags.
https://stackoverflow.com/a/3069972

We may have tests for the following; (just to give ideas, not concrete suggestions):
should_fail_for_dynamically_added_scripts_without_sri_attrs
should_fail_for_dynamically_added_scripts_with_invalid_sri_attrs
should_pass_for_dynamically_added_scripts_with_valid_sri_attrs

Add check for hashes

Compute the hashes of the resource and compare with the given hash.

ReferenceError: btoa is not defined

Received a ReferenceError for btoa. Maybe it's because of my node version:

sri-checker/src/scrape.js

Line 129 in 39d1282

var filename = btoa(target)

Perhaps we can change it with: let filename = Buffer.from(target).toString('base64');

We could also consider including the hostname of the target so the files are more human readable, but that's an optional feature.
Here's how Tracker Radar Collector name files:

• https://github.com/duckduckgo/tracker-radar-collector/blob/98573103f11eb0a830e93a26bab77dd2a040339c/helpers/hash.js#L7
• https://github.com/duckduckgo/tracker-radar-collector/blob/98573103f11eb0a830e93a26bab77dd2a040339c/cli/crawl-cli.js#L76

Add dynamic insert test in scraper with delay

Test for #26

Fix automatic upload of docs to Github Pages

Fix end to end test

By locally hosting the test scripts so they do not depend on the state of W3C or the internet connection.

Scrape URL for link and script tags

Add check for connection protocol used

SRI over HTTP is a bad idea.

Add check for cross-origin tag

Check if this matches the request header.

Fix bug in tests for NPM versions below 16