Add integrity hashes for remote scripts and stylesheets #61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Why these changes are being introduced: It's good practice to validate checksums for external libraries. We've done this in individual apps, but it makes sense to make the change in the theme gem. Relevant ticket(s): * [ENGX-290](https://mitlibraries.atlassian.net/browse/ENGX-290) How this addresses that need: This adds `integrity`, `crossorigin`, and `referrerpolicy` attributes for remotely hosted scripts and stylesheets. Side effects of this change: I'm not totally sure how to exhaustively test these changes. I've confirmed that the scripts/stylesheets load as expected, and checked the changes locally in a few of our apps. That feels like enough, but just signaling the uncertainty here in case the reviewer has additional insight.
Pull Request Test Coverage Report for Build 13910011954Details
💛 - Coveralls |
JPrevost
approved these changes
Mar 31, 2025
|
No worries, thanks for the review! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why these changes are being introduced:
It's good practice to validate checksums for external libraries. We've done this in individual apps, but it makes sense to make the change in the theme gem.
Relevant ticket(s):
How this addresses that need:
This adds
integrity,crossorigin, andreferrerpolicyattributes for remotely hosted scripts and stylesheets.Side effects of this change:
I'm not totally sure how to exhaustively test these changes. I've confirmed that the scripts/stylesheets load as expected, and checked the changes locally in a few of our apps. That feels like enough, but just signaling the uncertainty here in case the reviewer has additional insight.
Developer
our guide and
all issues introduced by these changes have been resolved or opened as new
issues (link to those issues in the Pull Request details above)
Code Reviewer
(not just this pull request message)
Requires database migrations?
NO
Includes new or updated dependencies?
NO