diff options
| author | Connor Shea <connor.james.shea@gmail.com> | 2016-06-20 13:38:17 -0600 |
|---|---|---|
| committer | Connor Shea <connor.james.shea@gmail.com> | 2016-06-22 16:22:45 -0600 |
| commit | 97ec04ac9b923ff9eb68ce51a35150d45105adf1 (patch) | |
| tree | 66daa1e13cfbf532e41bfca0014fd571620f8fff | |
| parent | cef021917f0fdf0fd3c24c41d6fd9ee1ed79e8d8 (diff) | |
| download | gitlab-ce-97ec04ac9b923ff9eb68ce51a35150d45105adf1.tar.gz | |
Add Subresource Integrity attribute to CSS and JS assets.
This prevents compromised or malicious CDNs from modifying assets. The hash provided by Rails is compared to the hash of the asset the browser has downloaded. The browser will refuse to execute/parse the assets if the hashes don't match. SRI is currently implemented in Firefox, Chrome, and Opera.
More information is available in #18230 and on MDN: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
This doesn't apply to the dynamically-generated per-page JavaScript due to a bug in sprockets-rails (https://github.com/rails/sprockets-rails/issues/359).
| -rw-r--r-- | app/views/layouts/_head.html.haml | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/app/views/layouts/_head.html.haml b/app/views/layouts/_head.html.haml index e0ed657919e..be29ed532ee 100644 --- a/app/views/layouts/_head.html.haml +++ b/app/views/layouts/_head.html.haml @@ -25,10 +25,10 @@ = favicon_link_tag 'favicon.ico' - = stylesheet_link_tag "application", media: "all" - = stylesheet_link_tag "print", media: "print" + = stylesheet_link_tag "application", media: "all", integrity: true + = stylesheet_link_tag "print", media: "print", integrity: true - = javascript_include_tag "application" + = javascript_include_tag "application", integrity: true - if page_specific_javascripts = javascript_include_tag page_specific_javascripts, {"data-turbolinks-track" => true} |