Implementing Subresource Integrity (#1729)

* Add sprockets-rails to Gemfile * Add sprockets-rails to Gemfile.lock * Update show.html.haml * Update index.html.haml * Update admin.html.haml * Update auth.html.haml * Update embedded.html.haml * Update public.html.haml
7 years ago · a6807201d2
parent 4445ebdad2
commit a6807201d2
8 changed files with 8 additions and 6 deletions
--- a/1
+++ b/1
@ -50,6 +50,7 @@ gem 'sidekiq'
 gem 'sidekiq-unique-jobs'
 gem 'simple-navigation'
 gem 'simple_form'
+gem 'sprockets-rails', :require => 'sprockets/railtie'
 gem 'statsd-instrument'
 gem 'twitter-text'
 gem 'tzinfo-data'
--- a/Gemfile.lock
+++ b/Gemfile.lock
@ -520,6 +520,7 @@ DEPENDENCIES
  simple-navigation
  simple_form
  simplecov
+  sprockets-rails
  statsd-instrument
  twitter-text
  tzinfo-data
--- a/app/views/about/show.html.haml
+++ b/app/views/about/show.html.haml
@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true

 - content_for :page_title do
  = Rails.configuration.x.local_domain
--- a/app/views/home/index.html.haml
+++ b/app/views/home/index.html.haml
@ -3,6 +3,6 @@
    window.STREAMING_API_BASE_URL = '#{Rails.configuration.x.streaming_api_base_url}';
    window.INITIAL_STATE = #{json_escape(render(file: 'home/initial_state', formats: :json))}

-  = javascript_include_tag 'application'
+  = javascript_include_tag 'application', integrity: true

 = react_component 'Mastodon', default_props, class: 'app-holder', prerender: false
--- a/app/views/layouts/admin.html.haml
+++ b/app/views/layouts/admin.html.haml
@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true

 - content_for :content do
  .admin-wrapper
--- a/app/views/layouts/auth.html.haml
+++ b/app/views/layouts/auth.html.haml
@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true

 - content_for :content do
  .container
--- a/app/views/layouts/embedded.html.haml
+++ b/app/views/layouts/embedded.html.haml
@ -3,6 +3,6 @@
  %head
    %meta{:charset => 'utf-8'}/
    = stylesheet_link_tag 'application', media: 'all'
-    = javascript_include_tag 'application_public'
+    = javascript_include_tag 'application_public', integrity: true
  %body.embed
    = yield
--- a/app/views/layouts/public.html.haml
+++ b/app/views/layouts/public.html.haml
@ -1,5 +1,5 @@
 - content_for :header_tags do
-  = javascript_include_tag 'application_public'
+  = javascript_include_tag 'application_public', integrity: true

 - content_for :content do
  .container= yield