vite-plugin-sri4 5.0.0 → 5.1.0

package/README.md

@@ -1,6 +1,6 @@
 # vite-plugin-sri4
 
-![NPM Version](https://img.shields.io/npm/v/vite-plugin-sri4)
+[![NPM Version](https://img.shields.io/npm/v/vite-plugin-sri4)](https://www.npmjs.com/package/vite-plugin-sri4)
 [![codecov](https://codecov.io/gh/7a6163/vite-plugin-sri4/graph/badge.svg?token=GOVB4J3D19)](https://codecov.io/gh/7a6163/vite-plugin-sri4)
 ![License](https://img.shields.io/npm/l/vite-plugin-sri4)
 
@@ -180,13 +180,28 @@ A blacklist would have to catch every one of the bottom rows individually, and t
 
 **Pin a version in the URL.** `unpkg.com/react@18.3.1/…` answers `max-age=31536000`; `unpkg.com/react@18/…` answers `max-age=60`. Same for jsdelivr. This is the fix, not a workaround — a floating URL and an integrity attribute are contradictory by construction.
 
-**Or vouch for the host** when you know it is stable and it just does not say so:
+**Or vouch for the host** when you know it is stable and it just does not say so. The shape to look for is a URL that already carries a version, served by an origin that simply sends no `Cache-Control` at all:
+
+```
+https://js.tappaysdk.com/sdk/tpdirect/v5.19.2
+
+  access-control-allow-origin: *
+  (no cache-control header)
+```
+
+The version is in the path, so those bytes are as fixed as any `immutable` response — the origin just never says so. That is what `trustDomains` is for:
 
 ```js
-sri({ trustDomains: ['assets.internal.example'] })
+sri({ trustDomains: ['js.tappaysdk.com'] })
 ```
 
-Do not point `trustDomains` at a vendor's rolling URL. Stripe, for one, documents that `js.stripe.com/v3/` must not be pinned; forcing a hash onto it produces a page that works until their next deploy.
+**When not to use it.** `trustDomains` overrides the one check that stands between you and a hash that stops matching. Do not point it at:
+
+- **a URL without a version in it** — `js.stripe.com/v3/`, `cdn.tailwindcss.com`, `connect.facebook.net/en_US/sdk.js`. Stripe documents that `v3/` must not be pinned; forcing a hash onto it produces a page that works until their next deploy.
+- **a floating range** — `unpkg.com/react@18/…` resolves to whatever 18.x is current.
+- **a host that serves per-client responses** — `fonts.googleapis.com` answers `private` for a reason.
+
+The test is not "do I trust this vendor". It is "will these exact bytes still be at this exact URL after their next release". If the answer comes from the URL itself, `trustDomains` is right; if it comes from hope, use `bypassDomains`.
 
 **Or accept it and silence the warning** with `bypassDomains`. Third-party analytics and widget scripts are usually this case — they are built to auto-update, and there is nothing to pin:
 

package/dist/index.cjs

@@ -49,20 +49,14 @@ class ResourceCache {
  */
 class CacheManager {
   constructor() {
-    this.urlSupportCache = new ResourceCache();
     this.resourceCache = new ResourceCache();
   }
 
-  getUrlSupportCache() {
-    return this.urlSupportCache
-  }
-
   getResourceCache() {
     return this.resourceCache
   }
 
   clearAll() {
-    this.urlSupportCache.clear();
     this.resourceCache.clear();
   }
 }
@@ -165,35 +159,48 @@ function isImmutableResponse(cacheControl) {
 /**
  * Resource check with retry mechanism
  */
-async function checkResourceSupport(url, urlSupportCache, logger = null, trusted = false, retries = 2) {
-  if (urlSupportCache.has(url)) {
-    return urlSupportCache.get(url)
+/**
+ * Fetch an external resource and return its bytes, or null if it must not be
+ * hashed. The reason is always logged - a tag that silently ships without
+ * integrity is the thing that is easy to miss.
+ *
+ * One GET, not a HEAD probe followed by a GET. The headers the gates need
+ * arrive on the response that carries the bytes anyway, so probing separately
+ * doubled the requests and threw the useful copy away - and made the plugin
+ * depend on HEAD being served at all. It often is not: js.tappaysdk.com
+ * answers 403 to HEAD and 200 to GET, which used to read as "could not be
+ * checked" on a payment SDK, exactly the kind of script SRI is for.
+ *
+ * The cost is that a rejected resource is downloaded before it is rejected.
+ * That is the right side to lose on: the accepted case, which is every build
+ * that actually ships hashes, goes from two requests to one.
+ */
+async function fetchVerifiedResource(url, resourceCache, logger = null, trusted = false, retries = 1) {
+  if (resourceCache.has(url)) {
+    return resourceCache.get(url)
   }
 
+  const reject = (message) => {
+    if (logger && message) logger.warn(message);
+    resourceCache.set(url, null);
+    return null
+  };
+
   let lastError;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
 
-      const response = await fetch(url, {
-        method: 'HEAD',
-        signal: controller.signal
-      });
+      const response = await fetch(url, { signal: controller.signal });
 
       clearTimeout(timeoutId);
 
-      // Every path out of here that skips a resource says why. A tag that
-      // silently ships without integrity is the thing that is easy to miss.
       if (!response.ok) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: HEAD returned ${response.status}, so the resource ` +
-            'could not be checked. Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: the server answered ${response.status}. ` +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Only `*` can be verified at build time. Injecting integrity also means
@@ -202,16 +209,12 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // served from, that turns a working script into a blocked one.
       const corsHeader = response.headers.get('access-control-allow-origin');
       if (corsHeader !== '*') {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
-            `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
-            'cannot be verified at build time. ' +
-            'Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
+          `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
+          'cannot be verified at build time. ' +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Reachable and CORS-eligible is not the same property as byte-stable.
@@ -228,65 +231,14 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // so a vary-based gate would let that resource straight through.
       const cacheControl = response.headers.get('cache-control');
       if (!trusted && !isImmutableResponse(cacheControl)) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Cache-Control is ` +
-            `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
-            'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
-            'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
-            'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
-            "vendor's rolling URL ships a page that breaks on their next deploy."
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
-      }
-
-      urlSupportCache.set(url, true);
-      return true
-    } catch (error) {
-      lastError = error;
-      if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource check timed out: ${url}`);
-        }
-        break // Don't retry timeouts
-      }
-
-      // Don't wait after the last failed attempt
-      if (attempt < retries) {
-        await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
-      }
-    }
-  }
-
-  if (logger) {
-    logger.warn(`Failed to check resource support: ${url}`, lastError);
-  }
-  urlSupportCache.set(url, false);
-  return false
-}
-
-/**
- * Optimized resource fetching function with retry mechanism and caching
- */
-async function fetchResource(url, resourceCache, logger = null, retries = 1) {
-  // Check cache
-  if (resourceCache.has(url)) {
-    return resourceCache.get(url)
-  }
-
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
-
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeoutId);
-
-      if (!response.ok) {
-        throw new Error(`HTTP error! status: ${response.status}`)
+        return reject(
+          `Skipping SRI for ${url}: Cache-Control is ` +
+          `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
+          'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
+          'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
+          'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
+          "vendor's rolling URL ships a page that breaks on their next deploy."
+        )
       }
 
       const data = new Uint8Array(await response.arrayBuffer());
@@ -295,12 +247,10 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource fetch timed out: ${url}`);
-        }
-        break // Don't retry timeouts
+        return reject(`Skipping SRI for ${url}: the request timed out.`)
       }
 
+      // Don't wait after the last failed attempt
       if (attempt < retries) {
         await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
       }
@@ -308,8 +258,9 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
   }
 
   if (logger) {
-    logger.warn(`Failed to fetch external resource: ${url}`, lastError);
+    logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
   }
+  resourceCache.set(url, null);
   return null
 }
 
@@ -481,11 +432,9 @@ async function calculateIntegrity(
   let bundleFileName = null;
   if (fetchUrl) {
     const trusted = matchesDomain(fetchUrl, trustDomains, logger);
-    const isSupported = await checkResourceSupport(
-      fetchUrl, cacheManager.getUrlSupportCache(), logger, trusted
+    source = await fetchVerifiedResource(
+      fetchUrl, cacheManager.getResourceCache(), logger, trusted
     );
-    if (!isSupported) return null
-    source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
   } else if (!ownAsset && SCHEME_RE.test(url)) {
     // data:/blob: and unknown schemes cannot be resolved to a bundle asset

package/dist/index.js

@@ -45,20 +45,14 @@ class ResourceCache {
  */
 class CacheManager {
   constructor() {
-    this.urlSupportCache = new ResourceCache();
     this.resourceCache = new ResourceCache();
   }
 
-  getUrlSupportCache() {
-    return this.urlSupportCache
-  }
-
   getResourceCache() {
     return this.resourceCache
   }
 
   clearAll() {
-    this.urlSupportCache.clear();
     this.resourceCache.clear();
   }
 }
@@ -161,35 +155,48 @@ function isImmutableResponse(cacheControl) {
 /**
  * Resource check with retry mechanism
  */
-async function checkResourceSupport(url, urlSupportCache, logger = null, trusted = false, retries = 2) {
-  if (urlSupportCache.has(url)) {
-    return urlSupportCache.get(url)
+/**
+ * Fetch an external resource and return its bytes, or null if it must not be
+ * hashed. The reason is always logged - a tag that silently ships without
+ * integrity is the thing that is easy to miss.
+ *
+ * One GET, not a HEAD probe followed by a GET. The headers the gates need
+ * arrive on the response that carries the bytes anyway, so probing separately
+ * doubled the requests and threw the useful copy away - and made the plugin
+ * depend on HEAD being served at all. It often is not: js.tappaysdk.com
+ * answers 403 to HEAD and 200 to GET, which used to read as "could not be
+ * checked" on a payment SDK, exactly the kind of script SRI is for.
+ *
+ * The cost is that a rejected resource is downloaded before it is rejected.
+ * That is the right side to lose on: the accepted case, which is every build
+ * that actually ships hashes, goes from two requests to one.
+ */
+async function fetchVerifiedResource(url, resourceCache, logger = null, trusted = false, retries = 1) {
+  if (resourceCache.has(url)) {
+    return resourceCache.get(url)
   }
 
+  const reject = (message) => {
+    if (logger && message) logger.warn(message);
+    resourceCache.set(url, null);
+    return null
+  };
+
   let lastError;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
 
-      const response = await fetch(url, {
-        method: 'HEAD',
-        signal: controller.signal
-      });
+      const response = await fetch(url, { signal: controller.signal });
 
       clearTimeout(timeoutId);
 
-      // Every path out of here that skips a resource says why. A tag that
-      // silently ships without integrity is the thing that is easy to miss.
       if (!response.ok) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: HEAD returned ${response.status}, so the resource ` +
-            'could not be checked. Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: the server answered ${response.status}. ` +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Only `*` can be verified at build time. Injecting integrity also means
@@ -198,16 +205,12 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // served from, that turns a working script into a blocked one.
       const corsHeader = response.headers.get('access-control-allow-origin');
       if (corsHeader !== '*') {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
-            `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
-            'cannot be verified at build time. ' +
-            'Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
+          `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
+          'cannot be verified at build time. ' +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Reachable and CORS-eligible is not the same property as byte-stable.
@@ -224,65 +227,14 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // so a vary-based gate would let that resource straight through.
       const cacheControl = response.headers.get('cache-control');
       if (!trusted && !isImmutableResponse(cacheControl)) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Cache-Control is ` +
-            `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
-            'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
-            'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
-            'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
-            "vendor's rolling URL ships a page that breaks on their next deploy."
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
-      }
-
-      urlSupportCache.set(url, true);
-      return true
-    } catch (error) {
-      lastError = error;
-      if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource check timed out: ${url}`);
-        }
-        break // Don't retry timeouts
-      }
-
-      // Don't wait after the last failed attempt
-      if (attempt < retries) {
-        await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
-      }
-    }
-  }
-
-  if (logger) {
-    logger.warn(`Failed to check resource support: ${url}`, lastError);
-  }
-  urlSupportCache.set(url, false);
-  return false
-}
-
-/**
- * Optimized resource fetching function with retry mechanism and caching
- */
-async function fetchResource(url, resourceCache, logger = null, retries = 1) {
-  // Check cache
-  if (resourceCache.has(url)) {
-    return resourceCache.get(url)
-  }
-
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
-
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeoutId);
-
-      if (!response.ok) {
-        throw new Error(`HTTP error! status: ${response.status}`)
+        return reject(
+          `Skipping SRI for ${url}: Cache-Control is ` +
+          `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
+          'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
+          'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
+          'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
+          "vendor's rolling URL ships a page that breaks on their next deploy."
+        )
       }
 
       const data = new Uint8Array(await response.arrayBuffer());
@@ -291,12 +243,10 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource fetch timed out: ${url}`);
-        }
-        break // Don't retry timeouts
+        return reject(`Skipping SRI for ${url}: the request timed out.`)
       }
 
+      // Don't wait after the last failed attempt
       if (attempt < retries) {
         await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
       }
@@ -304,8 +254,9 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
   }
 
   if (logger) {
-    logger.warn(`Failed to fetch external resource: ${url}`, lastError);
+    logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
   }
+  resourceCache.set(url, null);
   return null
 }
 
@@ -477,11 +428,9 @@ async function calculateIntegrity(
   let bundleFileName = null;
   if (fetchUrl) {
     const trusted = matchesDomain(fetchUrl, trustDomains, logger);
-    const isSupported = await checkResourceSupport(
-      fetchUrl, cacheManager.getUrlSupportCache(), logger, trusted
+    source = await fetchVerifiedResource(
+      fetchUrl, cacheManager.getResourceCache(), logger, trusted
     );
-    if (!isSupported) return null
-    source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
   } else if (!ownAsset && SCHEME_RE.test(url)) {
     // data:/blob: and unknown schemes cannot be resolved to a bundle asset

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",