security config_error ai_generated true

缺少SRI完整性属性的脚本标签允许CDN篡改

Missing SRI integrity attribute on script tag allows CDN tampering

ID: security/missing-sri-integrity-attribute-allows-cdn-tampering

其他格式: JSON · Markdown 中文 · English
90%修复率
85%置信度
1证据数
2023-08-15首次发现

版本兼容性

版本状态引入弃用备注
Subresource Integrity spec (W3C) active — — —
Chrome 45+ active — — —
Firefox 43+ active — — —
Safari 13+ active — — —
Edge 17+ active — — —

根因分析

从CDN加载资源的脚本或链接标签缺少'integrity'属性，因此受感染的CDN可以在不被检测到的情况下提供恶意代码。

English

Script or link tags loading resources from a CDN lack the 'integrity' attribute, so a compromised CDN can serve malicious code without detection.

generic

官方文档

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

解决方案

  1. Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>
  2. Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.
  3. Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.

无效尝试

常见但无效的做法:

  1. 85% 失败

    The crossorigin attribute enables CORS but does not provide integrity verification; the resource can still be tampered with.

  2. 90% 失败

    Different CDNs serve different content; the hash must match the exact resource. Using a different URL without updating the hash causes a SRI mismatch.

  3. 95% 失败

    This removes all protection against CDN tampering, leaving the application vulnerable to supply-chain attacks.