From 75f4b333232ee99cd6af146c08a66c6ee4865f98 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Thu, 18 Nov 2021 18:50:44 -0500 Subject: [PATCH] set up SRI for future use by CSP v3 --- nginx/nginx.conf | 4 ++-- process-static | 11 ++++++++++- static/404.html | 8 ++++---- .../articles/attestation-compatibility-guide.html | 8 ++++---- static/articles/grapheneos-servers.html | 10 +++++----- static/articles/index.html | 8 ++++---- static/articles/server-traffic-shaping.html | 8 ++++---- .../sitewide-advertising-industry-opt-out.html | 8 ++++---- static/build.html | 8 ++++---- static/contact.html | 8 ++++---- static/donate.html | 8 ++++---- static/faq.html | 10 +++++----- static/features.html | 8 ++++---- static/history/copperheados.html | 8 ++++---- static/history/index.html | 8 ++++---- static/history/legacy-changelog.html | 8 ++++---- static/index.html | 10 +++++----- static/install/cli.html | 8 ++++---- static/install/index.html | 8 ++++---- static/install/web.html | 14 +++++++------- static/pdfviewer-privacy-policy.html | 8 ++++---- static/releases.html | 12 ++++++------ static/source.html | 8 ++++---- static/usage.html | 10 +++++----- 24 files changed, 109 insertions(+), 100 deletions(-) diff --git a/nginx/nginx.conf b/nginx/nginx.conf index efea91ca..61b901cb 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -74,7 +74,7 @@ http { map $http_cookie $preload_resources { "~*__Host-preload=1" ""; - default "; rel=preload; as=style, ; rel=preload; as=font; crossorigin, ; rel=preload; as=font; crossorigin, ; rel=preload; as=image"; + default "<{{path|/main.css}}>; rel=preload; as=style, ; rel=preload; as=font; crossorigin, ; rel=preload; as=font; crossorigin, <{{path|/mask-icon.svg}}>; rel=preload; as=image"; } server { @@ -259,7 +259,7 @@ http { add_header Cache-Control "public, max-age=604800"; } - location = /mask-icon.svg { + location = {{path|/mask-icon.svg}} { include snippets/security-headers.conf; add_header Cross-Origin-Resource-Policy "same-origin" always; add_header Cache-Control "public, max-age=31536000, immutable"; diff --git a/process-static b/process-static index 9f33578c..22532ebf 100755 --- a/process-static +++ b/process-static @@ -25,8 +25,17 @@ replace="" for file in static-tmp/**/*.css static-tmp/js/*.js static-tmp/mask-icon.svg; do hash=$(sha256sum "$file" | head -c 8) dest="$(dirname $file)/$hash.$(basename $file)" + + if [[ $file == *.css ]]; then + sri_hash=sha256-$(openssl dgst -sha256 -binary "$file" | openssl base64 -A) + replace+=";s@{{css|/${file#*/}}}@@g" + elif [[ $file == *.js ]]; then + sri_hash=sha256-$(openssl dgst -sha256 -binary "$file" | openssl base64 -A) + replace+=";s@{{js|/${file#*/}}}@@g" + fi + mv "$file" "$dest" - replace+=";s|/${file#*/}|/${dest#*/}|g" + replace+=";s@{{path|/${file#*/}}}@/${dest#*/}@g" done cp nginx/nginx.conf nginx.conf.tmp diff --git a/static/404.html b/static/404.html index 700f977f..f599def1 100644 --- a/static/404.html +++ b/static/404.html @@ -20,9 +20,9 @@ - + - + {{css|/main.css}} @@ -30,7 +30,7 @@