vite-plugin-sri4 1.8.0 → 1.8.2

package/dist/index.cjs

@@ -9,7 +9,8 @@ const DEFAULT_OPTIONS = {
   algorithm: 'sha384',
   bypassDomains: [],
   crossorigin: 'anonymous',
-  debug: false
+  debug: false,
+  inlineScripts: false
 };
 
 function log(message, options) {
@@ -20,6 +21,9 @@ function log(message, options) {
 
 function computeSri(content, algorithm = 'sha384') {
   try {
+    if (typeof content === 'string') {
+      content = Buffer.from(content, 'utf-8');
+    }
     const hash = node_crypto.createHash(algorithm)
       .update(content)
       .digest('base64');
@@ -49,14 +53,21 @@ async function externalResourceIsCorsEnabled(url, options) {
 function isBypassDomain(url, bypassDomains = []) {
   if (!bypassDomains.length) return false;
   try {
-    const parsedUrl = url.startsWith('//')
-      ? new URL(`http:${url}`)
-      : new URL(url, 'http://dummy');
+    let parsedUrl;
+    if (url.startsWith('//')) {
+      parsedUrl = new URL(`http:${url}`);
+    } else if (url.startsWith('http://') || url.startsWith('https://')) {
+      parsedUrl = new URL(url);
+    } else {
+      parsedUrl = new URL(url, 'http://dummy');
+    }
+
     return bypassDomains.some(
       (domain) => parsedUrl.hostname === domain ||
                  parsedUrl.hostname.endsWith(`.${domain}`)
     );
   } catch (e) {
+    console.error(`${LOG_PREFIX} Failed to parse URL: ${url}`, e);
     return false;
   }
 }
@@ -76,11 +87,23 @@ function getAllPossiblePaths(url) {
     url.replace(/^static\//, '')
   ];
 
-  const withoutHash = url.replace(/-[a-zA-Z0-9]+\./, '.');
+  // Handle Vite's hashed filenames (e.g., index-DPifqqS2.js -> index.js)
+  const withoutHash = url.replace(/-[a-zA-Z0-9]{8}\./, '.');
   if (withoutHash !== url) {
     paths.push(...getAllPossiblePaths(withoutHash));
   }
 
+  // Handle variations with and without /static/ prefix for hashed files
+  const hashedMatch = url.match(/^(?:\/static\/)?(.*?)-[a-zA-Z0-9]{8}(\..*?)$/);
+  if (hashedMatch) {
+    const [, base, ext] = hashedMatch;
+    paths.push(
+      `${base}${ext}`,
+      `/static/${base}${ext}`,
+      `static/${base}${ext}`
+    );
+  }
+
   return [...new Set(paths)];
 }
 
@@ -129,6 +152,9 @@ async function processTag(tag, url, options, sriMap) {
   let integrity = null;
 
   log(`Checking possible paths for ${url}:`, options);
+  log(`Possible paths:`, options);
+  possiblePaths.forEach(path => log(`  - ${path}`, options));
+
   for (const path of possiblePaths) {
     log(`- Checking path: ${path}`, options);
     if (sriMap.has(path)) {
@@ -152,6 +178,29 @@ async function processTag(tag, url, options, sriMap) {
   return tag;
 }
 
+async function processInlineScript(tag, options) {
+  if (tag.includes('integrity=')) {
+    log(`Skip inline script with existing integrity attribute: ${tag}`, options);
+    return tag;
+  }
+
+  const content = tag.match(/<script[^>]*>([\s\S]*?)<\/script>/)?.[1]?.trim();
+  if (!content) {
+    log(`Skip empty inline script: ${tag}`, options);
+    return tag;
+  }
+
+  const hash = computeSri(content, options.algorithm);
+  if (hash) {
+    log(`Computing SRI for inline script: ${hash}`, options);
+    const newTag = tag.replace('>', ` integrity="${hash}">`);
+    log(`New inline script tag: ${newTag}`, options);
+    return newTag;
+  }
+
+  return tag;
+}
+
 function sri(userOptions = {}) {
   const options = { ...DEFAULT_OPTIONS, ...userOptions };
   const sriMap = new Map();
@@ -223,6 +272,16 @@ function sri(userOptions = {}) {
           html = html.replace(tag, newTag);
         }
 
+        // Process inline scripts if enabled
+        if (options.inlineScripts) {
+          const inlineScripts = html.match(/<script[^>]*>([^<]+)<\/script>/g) || [];
+          log(`Found ${inlineScripts.length} inline script tags`, options);
+          for (const tag of inlineScripts) {
+            const newTag = await processInlineScript(tag, options);
+            html = html.replace(tag, newTag);
+          }
+        }
+
         // Process link tags
         const linkTags = html.match(/<link[^>]+href=["']([^"']+)["'][^>]*>/g) || [];
         log(`Found ${linkTags.length} link tags`, options);

package/dist/index.js

@@ -7,7 +7,8 @@ const DEFAULT_OPTIONS = {
   algorithm: 'sha384',
   bypassDomains: [],
   crossorigin: 'anonymous',
-  debug: false
+  debug: false,
+  inlineScripts: false
 };
 
 function log(message, options) {
@@ -18,6 +19,9 @@ function log(message, options) {
 
 function computeSri(content, algorithm = 'sha384') {
   try {
+    if (typeof content === 'string') {
+      content = Buffer.from(content, 'utf-8');
+    }
     const hash = createHash(algorithm)
       .update(content)
       .digest('base64');
@@ -47,14 +51,21 @@ async function externalResourceIsCorsEnabled(url, options) {
 function isBypassDomain(url, bypassDomains = []) {
   if (!bypassDomains.length) return false;
   try {
-    const parsedUrl = url.startsWith('//')
-      ? new URL(`http:${url}`)
-      : new URL(url, 'http://dummy');
+    let parsedUrl;
+    if (url.startsWith('//')) {
+      parsedUrl = new URL(`http:${url}`);
+    } else if (url.startsWith('http://') || url.startsWith('https://')) {
+      parsedUrl = new URL(url);
+    } else {
+      parsedUrl = new URL(url, 'http://dummy');
+    }
+
     return bypassDomains.some(
       (domain) => parsedUrl.hostname === domain ||
                  parsedUrl.hostname.endsWith(`.${domain}`)
     );
   } catch (e) {
+    console.error(`${LOG_PREFIX} Failed to parse URL: ${url}`, e);
     return false;
   }
 }
@@ -74,11 +85,23 @@ function getAllPossiblePaths(url) {
     url.replace(/^static\//, '')
   ];
 
-  const withoutHash = url.replace(/-[a-zA-Z0-9]+\./, '.');
+  // Handle Vite's hashed filenames (e.g., index-DPifqqS2.js -> index.js)
+  const withoutHash = url.replace(/-[a-zA-Z0-9]{8}\./, '.');
   if (withoutHash !== url) {
     paths.push(...getAllPossiblePaths(withoutHash));
   }
 
+  // Handle variations with and without /static/ prefix for hashed files
+  const hashedMatch = url.match(/^(?:\/static\/)?(.*?)-[a-zA-Z0-9]{8}(\..*?)$/);
+  if (hashedMatch) {
+    const [, base, ext] = hashedMatch;
+    paths.push(
+      `${base}${ext}`,
+      `/static/${base}${ext}`,
+      `static/${base}${ext}`
+    );
+  }
+
   return [...new Set(paths)];
 }
 
@@ -127,6 +150,9 @@ async function processTag(tag, url, options, sriMap) {
   let integrity = null;
 
   log(`Checking possible paths for ${url}:`, options);
+  log(`Possible paths:`, options);
+  possiblePaths.forEach(path => log(`  - ${path}`, options));
+
   for (const path of possiblePaths) {
     log(`- Checking path: ${path}`, options);
     if (sriMap.has(path)) {
@@ -150,6 +176,29 @@ async function processTag(tag, url, options, sriMap) {
   return tag;
 }
 
+async function processInlineScript(tag, options) {
+  if (tag.includes('integrity=')) {
+    log(`Skip inline script with existing integrity attribute: ${tag}`, options);
+    return tag;
+  }
+
+  const content = tag.match(/<script[^>]*>([\s\S]*?)<\/script>/)?.[1]?.trim();
+  if (!content) {
+    log(`Skip empty inline script: ${tag}`, options);
+    return tag;
+  }
+
+  const hash = computeSri(content, options.algorithm);
+  if (hash) {
+    log(`Computing SRI for inline script: ${hash}`, options);
+    const newTag = tag.replace('>', ` integrity="${hash}">`);
+    log(`New inline script tag: ${newTag}`, options);
+    return newTag;
+  }
+
+  return tag;
+}
+
 function sri(userOptions = {}) {
   const options = { ...DEFAULT_OPTIONS, ...userOptions };
   const sriMap = new Map();
@@ -221,6 +270,16 @@ function sri(userOptions = {}) {
           html = html.replace(tag, newTag);
         }
 
+        // Process inline scripts if enabled
+        if (options.inlineScripts) {
+          const inlineScripts = html.match(/<script[^>]*>([^<]+)<\/script>/g) || [];
+          log(`Found ${inlineScripts.length} inline script tags`, options);
+          for (const tag of inlineScripts) {
+            const newTag = await processInlineScript(tag, options);
+            html = html.replace(tag, newTag);
+          }
+        }
+
         // Process link tags
         const linkTags = html.match(/<link[^>]+href=["']([^"']+)["'][^>]*>/g) || [];
         log(`Found ${linkTags.length} link tags`, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",