vite-plugin-sri4 5.1.0 → 5.1.1

package/README.md

@@ -16,9 +16,11 @@ A Vite plugin to generate Subresource Integrity (SRI) hashes for your assets dur
 - [External Resources](#external-resources)
 - [When SRI Actually Helps](#when-sri-actually-helps)
 - [How It Attaches Hashes](#how-it-attaches-hashes)
+- [Differences from vite-plugin-sri3](#differences-from-vite-plugin-sri3)
 - [Example Project](#example-project)
 - [Best Practices](#best-practices)
 - [Troubleshooting](#troubleshooting)
+- [Testing](#testing)
 - [Contributing](#contributing)
 - [Inspiration](#inspiration)
 - [License](#license)
@@ -144,9 +146,11 @@ The `writeBundle` drift check above covers **your own build outputs only**. Ever
 
 An external URL pointing at someone else's origin is different. It is fetched **once, at build time, from your build machine**, and the hash is taken from that copy. An `integrity` attribute pins those bytes forever, so it is only correct on a URL whose bytes never change — and the origin is the only party that knows whether that is true.
 
-So the plugin asks it. An external resource is hashed only when **all three** hold:
+So the plugin asks it. One `GET` does the whole job — it carries both the bytes to hash and the headers the answer depends on. There is no separate `HEAD` probe, so a host that serves `GET` and refuses `HEAD` is not a problem; `js.tappaysdk.com` answers `403` to `HEAD` and `200` to `GET`, and is read correctly.
 
-1. **`HEAD` succeeds.** Otherwise there is nothing to check.
+An external resource is hashed only when **all three** hold:
+
+1. **The request succeeds.** A non-2xx response leaves nothing to check.
 2. **`Access-Control-Allow-Origin: *`.** Injecting `integrity` also injects `crossorigin`, so a response scoped to one specific origin — or to none — would turn a working resource into a blocked one.
 3. **The origin declares the URL immutable**: `Cache-Control: immutable`, or a `max-age` of a year or more — and nothing in the same header contradicting it. `private`, `no-store` and `no-cache` each veto it: freshness and shareability are orthogonal, so a per-client response can carry a long `max-age`, and `no-cache, max-age=<long>` is a real CDN spelling of "cache it, but revalidate every time". Or the host is in `trustDomains`.
 
@@ -247,7 +251,7 @@ There are three places a Vite plugin can compute SRI hashes, and they are not eq
 
 Only the entry chunk is affected, so a build without a dynamic import will not reveal the difference. As a second safeguard, every hashed file is re-hashed in `writeBundle` and the build fails if anything changed after the hash was taken.
 
-This ordering constraint was first identified by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which this plugin began as a fork of. Beyond it, this plugin adds `crossorigin` injection, a CORS pre-check with timeouts and retries for external resources, import map and manifest output for dynamically imported routes, `publicDir` resolution, and the drift check above.
+This ordering constraint was first identified by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which this plugin began as a fork of. See [Differences from vite-plugin-sri3](#differences-from-vite-plugin-sri3).
 
 ## Example Project
 
@@ -334,6 +338,20 @@ This will show:
 - Missing asset warnings
 - Bundle-key fallback matches (when a URL is resolved via suffix match)
 
+## Testing
+
+```bash
+npm test              # 174 tests
+npm run test:coverage # the same, with coverage thresholds enforced at 100%
+npm run test:mutation # Stryker, ~4 minutes
+```
+
+Coverage is held at **100%** of statements, branches, functions and lines, enforced by thresholds in `vitest.config.js` — an uncovered path fails the run rather than quietly lowering the number.
+
+Coverage only proves a line ran. Mutation testing changes the code and checks whether a test notices, which is a much harder bar: at 100% coverage this suite still let 162 mutants through on the first run. The gaps it found were real — `no-store` and the qualified `private="…"` / `no-cache="…"` forms were never exercised, the `publicDir` path-traversal guard had no test, `base: './'` and `base: ''` were unreachable from any test, and the immutability tests all used `max-age=31536000, immutable`, where **both** passing conditions hold at once, so neither was actually pinned.
+
+The mutation score is **81.19%**, with a break threshold of 80. The remaining survivors are mostly equivalent mutants — warning message wording, cache clearing that has no observable effect, and `typeof source === 'string' ? source : Buffer.from(source)`, whose two branches hash identically. Killing those would mean asserting log text verbatim, which costs more than it protects.
+
 ## Contributing
 
 We welcome contributions! Here's how you can help:
@@ -350,9 +368,31 @@ Please make sure to:
 - Follow the existing code style
 - Update the CHANGELOG.md
 
-## Inspiration
+## Differences from vite-plugin-sri3
+
+This plugin began as a fork of [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3) and the two have since diverged. Compared against sri3 `2.0.0`:
 
-This project was inspired by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which provides subresource integrity for Vite. We've built upon its foundation to create an enhanced version with additional features and improved compatibility.
+| | sri3 2.0.0 | sri4 5.1.0 |
+|---|---|---|
+| Vite range | `^3 ‖ ^4 ‖ ^5 ‖ ^6 ‖ ^7 ‖ ^8` | `^6.4 ‖ ^7 ‖ ^8` |
+| Bundle outputs | ✅ | ✅ |
+| `publicDir` assets | ✅ | ✅ |
+| `skip-sri` per-tag opt-out | ✅ | ✅ |
+| TypeScript definitions | ✅ | ✅ |
+| Hash algorithm | `sha384`, fixed | `sha256` / `sha384` / `sha512`, validated at startup |
+| `crossorigin` attribute | not injected | injected, `anonymous` or `use-credentials` |
+| External resources | fetched unconditionally | gated on reachability, CORS and immutability |
+| Timeout / retry / cache on those fetches | ❌ | ✅ |
+| `bypassDomains` / `trustDomains` | ❌ | ✅ |
+| Hash drift detection | ❌ | re-hashed in `writeBundle`, build fails on drift |
+| `import()`-loaded routes, SSR | ❌ | `importmap` and `manifest` options |
+| Hook ordering | monkey-patches Vite's `generateBundle` | repositions itself in `config.plugins` |
+
+**Where sri3 is the better fit:** it supports Vite 3 through 5, which this plugin dropped. If you are on an older Vite, it is the only one of the two that works.
+
+**The difference that matters most:** sri3 injects `integrity` without `crossorigin`. SRI on a cross-origin resource requires CORS, so a browser blocks a cross-origin `<script>` or `<link>` that carries `integrity` and no `crossorigin` — which makes sri3's external-resource support difficult to use for the case SRI is usually reached for. That gap is what most of the column above grew out of: injecting `crossorigin` means the CORS response has to be checked at build time, and checking it exposed everything else worth checking.
+
+## Inspiration
 
 Other projects that influenced this work:
 - [rollup-plugin-sri](https://github.com/JonasKruckenberg/rollup-plugin-sri)

package/dist/index.cjs

@@ -69,7 +69,7 @@ const DEFAULT_TIMEOUT = 5000;
  * Does an external URL's host match one of `domains`, or a subdomain of one?
  * Used by both `bypassDomains` and `trustDomains`.
  */
-function matchesDomain(url, domains = [], logger = null) {
+function matchesDomain(url, domains = [], logger) {
   if (!url || typeof url !== 'string' || !url.startsWith('http')) return false
   if (domains.length === 0) return false
 
@@ -79,9 +79,7 @@ function matchesDomain(url, domains = [], logger = null) {
       urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`)
     )
   } catch (error) {
-    if (logger) {
-      logger.warn(`Invalid URL: ${url}`, error);
-    }
+    logger.warn(`Invalid URL: ${url}`, error);
     return false
   }
 }
@@ -175,13 +173,13 @@ function isImmutableResponse(cacheControl) {
  * That is the right side to lose on: the accepted case, which is every build
  * that actually ships hashes, goes from two requests to one.
  */
-async function fetchVerifiedResource(url, resourceCache, logger = null, trusted = false, retries = 1) {
+async function fetchVerifiedResource(url, resourceCache, logger, trusted = false, retries = 1) {
   if (resourceCache.has(url)) {
     return resourceCache.get(url)
   }
 
   const reject = (message) => {
-    if (logger && message) logger.warn(message);
+    logger.warn(message);
     resourceCache.set(url, null);
     return null
   };
@@ -257,9 +255,7 @@ async function fetchVerifiedResource(url, resourceCache, logger = null, trusted
     }
   }
 
-  if (logger) {
-    logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
-  }
+  logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
   resourceCache.set(url, null);
   return null
 }
@@ -333,14 +329,14 @@ function getBundleKey(htmlPath, url, config) {
  * `assets/vendor-main.js` - a cross-filename match would inject a valid-looking
  * but wrong hash, which the browser rejects with no build-time error.
  */
-function findBundleKey(bundle, bundleKey, logger = null) {
+function findBundleKey(bundle, bundleKey, logger) {
   const candidates = Object.keys(bundle).filter(key =>
     key === bundleKey ||
     key.endsWith(`/${bundleKey}`) ||
     bundleKey.endsWith(`/${key}`)
   );
 
-  if (candidates.length > 1 && logger) {
+  if (candidates.length > 1) {
     logger.warn(
       `Ambiguous bundle key for "${bundleKey}": ${candidates.join(', ')} - using ${candidates[0]}`
     );
@@ -374,17 +370,13 @@ async function readPublicAsset(config, bundleKey, logger) {
   // A URL must never reach outside publicDir, however it is spelled
   const relative = path.relative(publicDir, filePath);
   if (relative.startsWith('..') || path.isAbsolute(relative)) {
-    if (logger) {
-      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
-    }
+    logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
     return null
   }
 
   try {
     const source = await promises.readFile(filePath);
-    if (logger) {
-      logger.debug(`Resolved from publicDir: ${bundleKey}`);
-    }
+    logger.debug(`Resolved from publicDir: ${bundleKey}`);
     return source
   } catch {
     return null
@@ -401,7 +393,7 @@ async function calculateIntegrity(
   options,
   config,
   cacheManager,
-  logger = null
+  logger
 ) {
   const {
     ignoreMissingAsset,
@@ -438,9 +430,7 @@ async function calculateIntegrity(
     if (!source) return null
   } else if (!ownAsset && SCHEME_RE.test(url)) {
     // data:/blob: and unknown schemes cannot be resolved to a bundle asset
-    if (logger) {
-      logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
-    }
+    logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
     return null
   } else {
     const bundleKey = getBundleKey(htmlPath, url, config);
@@ -453,9 +443,7 @@ async function calculateIntegrity(
       const possibleMatch = findBundleKey(bundle, bundleKey, logger);
 
       if (possibleMatch) {
-        if (logger) {
-          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
-        }
+        logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
       } else {
@@ -464,11 +452,9 @@ async function calculateIntegrity(
 
         if (!source) {
           if (ignoreMissingAsset) {
-            if (logger) {
-              logger.warn(
-                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
-              );
-            }
+            logger.warn(
+              `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+            );
             return null
           }
           throw new Error(
@@ -519,7 +505,9 @@ const SRI_LINK_RELS = new Set(['stylesheet', 'modulepreload']);
 function getAttr(tag, re) {
   const match = tag.match(re);
   if (!match) return null
-  return match[1] ?? match[2] ?? match[3] ?? null
+  // One of the three alternatives matched or the regex would not have, and an
+  // empty value is a string rather than undefined - so there is no fourth case.
+  return match[1] ?? match[2] ?? match[3]
 }
 
 const HTML_PATTERNS = {
@@ -771,9 +759,7 @@ async function transformHTML(
 function createTransformer(options, config, cacheManager, logger) {
   return {
     transformHTML: (bundle, htmlPath, html) =>
-      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
-    calculateIntegrity: (bundle, htmlPath, url) =>
-      calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
+      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger)
   }
 }
 
@@ -844,13 +830,6 @@ class Logger {
       console.debug(...this.formatMessage(message, ...args));
     }
   }
-
-  /**
-   * Create a child logger with the same configuration
-   */
-  child(name) {
-    return new Logger(this.logLevel, `${this.pluginName}:${name}`)
-  }
 }
 
 // Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds

package/dist/index.js

@@ -65,7 +65,7 @@ const DEFAULT_TIMEOUT = 5000;
  * Does an external URL's host match one of `domains`, or a subdomain of one?
  * Used by both `bypassDomains` and `trustDomains`.
  */
-function matchesDomain(url, domains = [], logger = null) {
+function matchesDomain(url, domains = [], logger) {
   if (!url || typeof url !== 'string' || !url.startsWith('http')) return false
   if (domains.length === 0) return false
 
@@ -75,9 +75,7 @@ function matchesDomain(url, domains = [], logger = null) {
       urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`)
     )
   } catch (error) {
-    if (logger) {
-      logger.warn(`Invalid URL: ${url}`, error);
-    }
+    logger.warn(`Invalid URL: ${url}`, error);
     return false
   }
 }
@@ -171,13 +169,13 @@ function isImmutableResponse(cacheControl) {
  * That is the right side to lose on: the accepted case, which is every build
  * that actually ships hashes, goes from two requests to one.
  */
-async function fetchVerifiedResource(url, resourceCache, logger = null, trusted = false, retries = 1) {
+async function fetchVerifiedResource(url, resourceCache, logger, trusted = false, retries = 1) {
   if (resourceCache.has(url)) {
     return resourceCache.get(url)
   }
 
   const reject = (message) => {
-    if (logger && message) logger.warn(message);
+    logger.warn(message);
     resourceCache.set(url, null);
     return null
   };
@@ -253,9 +251,7 @@ async function fetchVerifiedResource(url, resourceCache, logger = null, trusted
     }
   }
 
-  if (logger) {
-    logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
-  }
+  logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
   resourceCache.set(url, null);
   return null
 }
@@ -329,14 +325,14 @@ function getBundleKey(htmlPath, url, config) {
  * `assets/vendor-main.js` - a cross-filename match would inject a valid-looking
  * but wrong hash, which the browser rejects with no build-time error.
  */
-function findBundleKey(bundle, bundleKey, logger = null) {
+function findBundleKey(bundle, bundleKey, logger) {
   const candidates = Object.keys(bundle).filter(key =>
     key === bundleKey ||
     key.endsWith(`/${bundleKey}`) ||
     bundleKey.endsWith(`/${key}`)
   );
 
-  if (candidates.length > 1 && logger) {
+  if (candidates.length > 1) {
     logger.warn(
       `Ambiguous bundle key for "${bundleKey}": ${candidates.join(', ')} - using ${candidates[0]}`
     );
@@ -370,17 +366,13 @@ async function readPublicAsset(config, bundleKey, logger) {
   // A URL must never reach outside publicDir, however it is spelled
   const relative = path.relative(publicDir, filePath);
   if (relative.startsWith('..') || path.isAbsolute(relative)) {
-    if (logger) {
-      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
-    }
+    logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
     return null
   }
 
   try {
     const source = await readFile(filePath);
-    if (logger) {
-      logger.debug(`Resolved from publicDir: ${bundleKey}`);
-    }
+    logger.debug(`Resolved from publicDir: ${bundleKey}`);
     return source
   } catch {
     return null
@@ -397,7 +389,7 @@ async function calculateIntegrity(
   options,
   config,
   cacheManager,
-  logger = null
+  logger
 ) {
   const {
     ignoreMissingAsset,
@@ -434,9 +426,7 @@ async function calculateIntegrity(
     if (!source) return null
   } else if (!ownAsset && SCHEME_RE.test(url)) {
     // data:/blob: and unknown schemes cannot be resolved to a bundle asset
-    if (logger) {
-      logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
-    }
+    logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
     return null
   } else {
     const bundleKey = getBundleKey(htmlPath, url, config);
@@ -449,9 +439,7 @@ async function calculateIntegrity(
       const possibleMatch = findBundleKey(bundle, bundleKey, logger);
 
       if (possibleMatch) {
-        if (logger) {
-          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
-        }
+        logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
       } else {
@@ -460,11 +448,9 @@ async function calculateIntegrity(
 
         if (!source) {
           if (ignoreMissingAsset) {
-            if (logger) {
-              logger.warn(
-                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
-              );
-            }
+            logger.warn(
+              `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+            );
             return null
           }
           throw new Error(
@@ -515,7 +501,9 @@ const SRI_LINK_RELS = new Set(['stylesheet', 'modulepreload']);
 function getAttr(tag, re) {
   const match = tag.match(re);
   if (!match) return null
-  return match[1] ?? match[2] ?? match[3] ?? null
+  // One of the three alternatives matched or the regex would not have, and an
+  // empty value is a string rather than undefined - so there is no fourth case.
+  return match[1] ?? match[2] ?? match[3]
 }
 
 const HTML_PATTERNS = {
@@ -767,9 +755,7 @@ async function transformHTML(
 function createTransformer(options, config, cacheManager, logger) {
   return {
     transformHTML: (bundle, htmlPath, html) =>
-      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
-    calculateIntegrity: (bundle, htmlPath, url) =>
-      calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
+      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger)
   }
 }
 
@@ -840,13 +826,6 @@ class Logger {
       console.debug(...this.formatMessage(message, ...args));
     }
   }
-
-  /**
-   * Create a child logger with the same configuration
-   */
-  child(name) {
-    return new Logger(this.logLevel, `${this.pluginName}:${name}`)
-  }
 }
 
 // Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "5.1.0",
+  "version": "5.1.1",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -24,7 +24,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test:mutation": "stryker run"
   },
   "peerDependencies": {
     "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
@@ -32,6 +33,8 @@
   "devDependencies": {
     "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-node-resolve": "^16.0.3",
+    "@stryker-mutator/core": "^10.0.0",
+    "@stryker-mutator/vitest-runner": "^10.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "oxlint": "^1.82.0",
     "rollup": "^4.63.1",