{
  "id": "security/missing-sri-integrity-attribute-allows-cdn-tampering",
  "signature": "Missing SRI integrity attribute on script tag allows CDN tampering",
  "signature_zh": "缺少SRI完整性属性的脚本标签允许CDN篡改",
  "regex": "The resource .* from .* was blocked due to missing integrity attribute|SRI check failed: integrity attribute missing",
  "domain": "security",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "Script or link tags loading resources from a CDN lack the 'integrity' attribute, so a compromised CDN can serve malicious code without detection.",
  "root_cause_type": "generic",
  "root_cause_zh": "从CDN加载资源的脚本或链接标签缺少'integrity'属性，因此受感染的CDN可以在不被检测到的情况下提供恶意代码。",
  "versions": [
    {
      "version": "Subresource Integrity spec (W3C)",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Chrome 45+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Firefox 43+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Safari 13+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Edge 17+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "The crossorigin attribute enables CORS but does not provide integrity verification; the resource can still be tampered with.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Different CDNs serve different content; the hash must match the exact resource. Using a different URL without updating the hash causes a SRI mismatch.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "This removes all protection against CDN tampering, leaving the application vulnerable to supply-chain attacks.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>",
      "success_rate": 0.9,
      "how": "Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>",
      "condition": "",
      "sources": []
    },
    {
      "action": "Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.",
      "success_rate": 0.95,
      "how": "Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.",
      "success_rate": 0.8,
      "how": "Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>",
    "Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.",
    "Use a CDN that supports SRI and automatically provides the integrity hash in the response headers."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2023-08-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}