Comments (3)
Quick solution: you could generate the hash for https://utteranc.es/client.js
using https://www.srihash.org
<script src="https://utteranc.es/client.js"
repo="jdanyow/utterances-demo"
issue-number="15"
async
+ integrity="sha384-Xzvl+Tf9crKsJBG5htkEvAri2XbSYf2jsxOcpHtkZ3xRUJsDvSOdxl78utgsbf1h"
+ crossorigin="anonymous"
+ onerror="insertAdjacentHTML('afterend', 'Error loading utterances. If you are the site owner and have enabled SRI, verify the hash value for https://utteranc.es/client.js at https://www.srihash.org/')">
</script>
Running example here: https://jsfiddle.net/jdanyow/8xjse6r1/ (edit the hash value to see the error behavior).
The trouble with this approach (as you know) is utterances will stop working on your site when an update is published that changes the client.js script. That script is not updated very often but indirect changes to things like the transpiler (typescript), bundler (parcel) or minifier (uglify) could cause the hash to change. I imagine this would happen quite often.
A proper solution would involve maintaining versioned builds so that folks wanting to use SRI could opt out of automatic updates. Eg <script src="https://utteranc.es/1.0.1/client.js" integrity="...." ....>
. For that to work long term I'd need to manage backwards compat all the way down to the api. Doable but I'm not sure I want to take on the extra work at this time.
Another option would be to create a "release notification" issue that folks could subscribe to where I could give notice of upcoming hash changes. Site owners could subscribe and update their integrity attributes ahead of the release (multiple hashes separated by whitespace are permitted in the integrity attribute). This would ensure the upgrade experience is seamless.
All that said, it's probably pointless to use SRI with the current utterances architecture. The utterances widget is sandboxed in an iframe for a couple reasons: 1) prevent host page styles from breaking the widget and visa versa and 2) prevent the host page from accessing the user's github auth token. Unfortunately there's no way to specify an integrity attribute for iframes. Initially iframes were in the working draft of the SRI spec but they never made it to the final draft. I don't think it's worthwhile to check the integrity of https://utteranc.es/client.js
if the first thing the script does is create an <iframe src="https://utteranc.es/utterances.html">
element which we cannot verify integrity on.
Does this make sense? Let me know if you have any questions/ideas to improve this.
from utterances.
@jdanyow Good point about the iframe. I was going to suggest hosting it locally as an alternative to versioned hosting, etc. Perhaps in that scenario you'd be able to verify the integrity of every local file using some kind of manifest? Here's a great writeup by CryptPad, who attempted to solve a similar issue.
from utterances.
@awnumar thanks for the link, this is interesting stuff. For now I think you could use the instructions in #42 to self-host and consider using utterances directly if we come up with a solution in the future.
from utterances.
Related Issues (20)
- Add a load button to comments
- is there a guide to add this to docusaurus ? HOT 1
- No links on nvidia shield tv for Hanime.tv
- Return Of The Max Doesn’t seems to work for me in Uk
- Utterances will not match to URLs exactly HOT 4
- Support flutter
- It seems that setting the theme to preferred-color-scheme doesn't work.
- Not issue HOT 3
- Use CSS variabel for theme switching
- Support for guest-comments HOT 1
- test
- Unable to setup utteranc.es HOT 1
- Is it possible to configure bot's initial post comment?
- Initial comment - needs better documentation HOT 1
- [Feature] Threading — nested responses.
- [Feature] Permalink to comments.
- 可以评论到Discussions吗? HOT 2
- Add Image Upload Options
- How to get around CORs HOT 1
- 404 on requesting css. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from utterances.