# 缺少SRI完整性属性的脚本标签允许CDN篡改

- **ID:** `security/missing-sri-integrity-attribute-allows-cdn-tampering`
- **领域:** security
- **类别:** config_error
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

从CDN加载资源的脚本或链接标签缺少'integrity'属性，因此受感染的CDN可以在不被检测到的情况下提供恶意代码。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Subresource Integrity spec (W3C) | active | — | — |
| Chrome 45+ | active | — | — |
| Firefox 43+ | active | — | — |
| Safari 13+ | active | — | — |
| Edge 17+ | active | — | — |

## 解决方案

1. ```
   Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>
   ```
2. ```
   Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.
   ```
3. ```
   Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.
   ```

## 无效尝试

- **** — The crossorigin attribute enables CORS but does not provide integrity verification; the resource can still be tampered with. (85% 失败率)
- **** — Different CDNs serve different content; the hash must match the exact resource. Using a different URL without updating the hash causes a SRI mismatch. (90% 失败率)
- **** — This removes all protection against CDN tampering, leaving the application vulnerable to supply-chain attacks. (95% 失败率)