jonathankingston/broccoli-sri-hash

Rewrites HTML files with SRI hashes

broccoli-sri-hash's Issues

Is it possible to exclude a single file, so the it ends up without the integrity attribute ?

Is it possible to exclude a single file, so the it ends up without the integrity attribute ?

Missing support for Link preload and prefetch

Preload and prefetch links should also have calculated integrity otherwise the preloaded resources are not used

A preload for 'abc.css' is found, but is not used due to an integrity mismatch.

Actual:

<link rel="preload" href="/assets/vendor.css" as="style">
<link rel="prefetch" href="/assets/vendor.css" as="style">

Expected:

<link rel="preload" href="/assets/vendor.css" as="style" integrity="123213">
<link rel="prefetch" href="/assets/vendor.css" as="style" integrity="123213">

Ember CLI: ENOENT, no such file or directory ... index.html w/ 1.2.0

I get the following trace in my Ember CLI project with broccoli-sri-hash 1.2.0, depended upon by ember-cli-sri. If I manually rollback to broccoli-sri-hash 1.1.1, the problem goes away.

➜ ember test
Future versions of Ember CLI will not support v0.10.40. Please update to Node 0.12 or io.js.
version: 1.13.8
Invalid watchman found, version: [4.1.0] did not satisfy [^3.0.0], falling back to NodeWatcher.
Visit http://www.ember-cli.com/user-guide/#watchman for more info.
Build failed.
ENOENT, no such file or directory '/path/to/my-cool-app/tmp/srihash_assets-output_path-S8FPzcEu.tmp/my-cool-app/index.html'
Error: ENOENT, no such file or directory '/path/to/my-cool-app/tmp/srihash_assets-output_path-S8FPzcEu.tmp/my-cool-app/index.html'
    at Object.fs.openSync (fs.js:439:18)
    at Object.fs.writeFileSync (fs.js:978:15)
    at SRIHashAssets.processFile [as processHTMLFile] (/path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/index.js:208:6)
    at Array.map (native)
    at SRIHashAssets.build (/path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/index.js:228:22)
    at /path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/node_modules/broccoli-caching-writer/index.js:152:21
    at lib$rsvp$$internal$$tryCatch (/path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/node_modules/rsvp/dist/rsvp.js:493:16)
    at lib$rsvp$$internal$$invokeCallback (/path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/node_modules/rsvp/dist/rsvp.js:505:17)
    at lib$rsvp$$internal$$publish (/path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/node_modules/rsvp/dist/rsvp.js:476:11)
    at Object.lib$rsvp$asap$$flush [as _onImmediate] (/path/to/my-cool-app/node_modules/ember-cli-sri/node_modules/broccoli-sri-hash/node_modules/rsvp/dist/rsvp.js:1198:9)

any-change causes everything to be dirtied

causing: ember-cli/ember-cli#5485

It does mean a more complicated filter, but I suspect that is something we will just have to do.

re-enable snyk

disabled here

it was catching

> [email protected] test /Users/stefanpenner/src/broccoli-sri-hash
> snyk test && mocha test

✗ Vulnerability found on [email protected]
Info: https://app.snyk.io/vuln/npm:uglify-js:20150824
From: [email protected] > [email protected] > uglify-js@~2.3
Upgrade direct dependency [email protected] to [email protected] (triggers upgrades to [email protected])

which doesn't actually affect broccoli, or this plugin.

broccoli issue: broccolijs/broccoli#286

Add crossorigin property to elements

As suggested by @metromoxie adding crossorigin property:

https://twitter.com/metromoxie/status/613824343001268224

Suggestion:

• Accept an origin in the options passed into the plugin.
• Use origin to determine which URLs are remote to the page
• For script or link tags that don't have a crossorigin property set it to crossorigin="anonymous" if the resource isn't loaded from the current path.

Decide upon a method to exclude or include third party library code that should not have an integrity.

Does not take `base` tag into account.

Currently, when processing tests/index.html that has:

<base href="/">
<script src="assets/vendor.js"></script>

We look for tests/assets/vendor.js, but we should be looking for assets/vendor.js. This means that no integrity= attributes are added for tests/index.html (but they are properly added for index.html). This is also causing the ember-cli-sri tests to fail (because none of the <script> or <link> tags get integrity= attributes added).

should use BCW

JS file changes don't invalidate the html file, so the HTML file can get stale

ember-cli/ember-cli#5110

Fix link to only include only stylesheet

link element that has a rel attribute with the value of stylesheet