vite-plugin-sri4 1.2.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +1 -1
  2. package/dist/index.cjs +14 -4
  3. package/dist/index.js +14 -4
  4. package/package.json +2 -2
package/README.md CHANGED
@@ -1,7 +1,7 @@
1
1
  # vite-plugin-sri4
2
2
 
3
3
  ![NPM Version](https://img.shields.io/npm/v/vite-plugin-sri4)
4
- [![codecov](https://codecov.io/gh/7a6163/vite-plugin-sri4/branch/main/graph/badge.svg)](https://codecov.io/gh/7a6163/vite-plugin-sri4)
4
+ [![codecov](https://codecov.io/gh/7a6163/vite-plugin-sri4/graph/badge.svg?token=GOVB4J3D19)](https://codecov.io/gh/7a6163/vite-plugin-sri4)
5
5
 
6
6
  A Vite plugin to generate Subresource Integrity (SRI) hashes for your assets during the build process. This plugin computes SRI hashes for JavaScript and CSS files and injects them as `integrity` and `crossorigin="anonymous"` attributes into your HTML, ensuring your resources have not been tampered with when loaded by browsers.
7
7
 
package/dist/index.cjs CHANGED
@@ -1,7 +1,7 @@
1
1
  'use strict';
2
2
 
3
3
  var node_crypto = require('node:crypto');
4
- var fetch = require('node-fetch');
4
+ var fetch = require('cross-fetch');
5
5
 
6
6
  const DEFAULT_OPTIONS = {
7
7
  algorithm: 'sha384',
@@ -32,7 +32,7 @@ async function externalResourceIsCorsEnabled(url, options) {
32
32
  try {
33
33
  const response = await fetch(url, {
34
34
  method: 'HEAD',
35
- timeout: 5000 // 5 seconds timeout
35
+ timeout: 5000
36
36
  });
37
37
  const acao = response.headers.get('access-control-allow-origin');
38
38
  if (acao && (acao === '*' || acao.includes(options.domain || ''))) {
@@ -86,12 +86,17 @@ function isBypassDomain(url, bypassDomains = []) {
86
86
  }
87
87
  }
88
88
 
89
+ function hasCrossOriginAttr(tag) {
90
+ return /crossorigin=/i.test(tag);
91
+ }
92
+
89
93
  function sri(userOptions = {}) {
90
94
  const options = { ...DEFAULT_OPTIONS, ...userOptions };
91
95
  const sriMap = new Map();
92
96
 
93
97
  return {
94
98
  name: 'vite-plugin-sri4',
99
+ enforce: 'post',
95
100
  apply: 'build',
96
101
 
97
102
  configResolved(config) {
@@ -143,6 +148,13 @@ function sri(userOptions = {}) {
143
148
  const integrity = sriMap.get(fileName);
144
149
 
145
150
  if (integrity) {
151
+ const hasCrossOrigin = hasCrossOriginAttr(tag);
152
+ if (hasCrossOrigin) {
153
+ return tag.replace(
154
+ />$/,
155
+ ` integrity="${integrity}">`
156
+ );
157
+ }
146
158
  return tag.replace(
147
159
  />$/,
148
160
  ` integrity="${integrity}" crossorigin="${options.crossorigin}">`
@@ -152,14 +164,12 @@ function sri(userOptions = {}) {
152
164
  return tag;
153
165
  };
154
166
 
155
- // Process scripts
156
167
  html = await replaceAsync(
157
168
  html,
158
169
  /(<script[^>]+(?:src="([^"]+)"[^>]*|type="module"[^>]*src="([^"]+)"[^>]*)>)/g,
159
170
  processTag
160
171
  );
161
172
 
162
- // Process links
163
173
  html = await replaceAsync(
164
174
  html,
165
175
  /(<link[^>]+href="([^"]+)"[^>]*>)/g,
package/dist/index.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { createHash } from 'node:crypto';
2
- import fetch from 'node-fetch';
2
+ import fetch from 'cross-fetch';
3
3
 
4
4
  const DEFAULT_OPTIONS = {
5
5
  algorithm: 'sha384',
@@ -30,7 +30,7 @@ async function externalResourceIsCorsEnabled(url, options) {
30
30
  try {
31
31
  const response = await fetch(url, {
32
32
  method: 'HEAD',
33
- timeout: 5000 // 5 seconds timeout
33
+ timeout: 5000
34
34
  });
35
35
  const acao = response.headers.get('access-control-allow-origin');
36
36
  if (acao && (acao === '*' || acao.includes(options.domain || ''))) {
@@ -84,12 +84,17 @@ function isBypassDomain(url, bypassDomains = []) {
84
84
  }
85
85
  }
86
86
 
87
+ function hasCrossOriginAttr(tag) {
88
+ return /crossorigin=/i.test(tag);
89
+ }
90
+
87
91
  function sri(userOptions = {}) {
88
92
  const options = { ...DEFAULT_OPTIONS, ...userOptions };
89
93
  const sriMap = new Map();
90
94
 
91
95
  return {
92
96
  name: 'vite-plugin-sri4',
97
+ enforce: 'post',
93
98
  apply: 'build',
94
99
 
95
100
  configResolved(config) {
@@ -141,6 +146,13 @@ function sri(userOptions = {}) {
141
146
  const integrity = sriMap.get(fileName);
142
147
 
143
148
  if (integrity) {
149
+ const hasCrossOrigin = hasCrossOriginAttr(tag);
150
+ if (hasCrossOrigin) {
151
+ return tag.replace(
152
+ />$/,
153
+ ` integrity="${integrity}">`
154
+ );
155
+ }
144
156
  return tag.replace(
145
157
  />$/,
146
158
  ` integrity="${integrity}" crossorigin="${options.crossorigin}">`
@@ -150,14 +162,12 @@ function sri(userOptions = {}) {
150
162
  return tag;
151
163
  };
152
164
 
153
- // Process scripts
154
165
  html = await replaceAsync(
155
166
  html,
156
167
  /(<script[^>]+(?:src="([^"]+)"[^>]*|type="module"[^>]*src="([^"]+)"[^>]*)>)/g,
157
168
  processTag
158
169
  );
159
170
 
160
- // Process links
161
171
  html = await replaceAsync(
162
172
  html,
163
173
  /(<link[^>]+href="([^"]+)"[^>]*>)/g,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "vite-plugin-sri4",
3
- "version": "1.2.0",
3
+ "version": "1.4.0",
4
4
  "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
5
5
  "type": "module",
6
6
  "main": "./dist/index.cjs",
@@ -23,7 +23,7 @@
23
23
  "prepublishOnly": "npm run build"
24
24
  },
25
25
  "dependencies": {
26
- "node-fetch": "^3.3.2"
26
+ "cross-fetch": "^4.1.0"
27
27
  },
28
28
  "peerDependencies": {
29
29
  "vite": "^4.0.0 || ^5.0.0 || ^6.0.0"