Add Subresource Integrity to Snippet

Gruntfile.js

@@ -13,8 +13,10 @@ var glob = require('glob');
 var path = require('path');
 var pkg = require('./package.json');
 var fs = require('fs');
+var webpack = require('webpack');
 
 var webpackConfig = require('./webpack.config.js');
+var webpackSnippetConfig = require('./webpack.config.snippet.js');
 var browserStackBrowsers = require('./browserstack.browsers');
 
 
@@ -156,7 +158,7 @@ module.exports = function(grunt) {
 
   grunt.initConfig({
     pkg: pkg,
-    webpack: webpackConfig,
+    webpack: [...webpackConfig, webpackSnippetConfig],
     vows: {
       all: {
         options: {
@@ -202,10 +204,21 @@ module.exports = function(grunt) {
     }
   });
 
+  grunt.registerTask('build', function build() {
+    var done = this.async();
+    webpack(webpackConfig, (error) => {
+      if (error) throw error;
+
+      webpack(webpackSnippetConfig, (error) => {
+        if (error) throw error;
+        done();
+      })
+    })
+  })
   grunt.registerTask('build', ['webpack', 'replace:snippets']);
   grunt.registerTask('default', ['build']);
   grunt.registerTask('test', ['test-server', 'test-browser']);
-  grunt.registerTask('release', ['build', 'copyrelease']);
+  grunt.registerTask('release', ['build', 'replace:snippets', 'copyrelease']);
 
   grunt.registerTask('test-server', function(_target) {
     var tasks = ['vows'];

package.json

@@ -90,6 +90,7 @@
     "time-grunt": "^1.0.0",
     "vows": "^0.8.3",
     "webpack": "^4.41.3",
+    "webpack-assets-manifest": "^3.1.1",
     "webpack-dev-server": "^3.1.10"
   },
   "optionalDependencies": {

src/browser/bundles/rollbar.snippet.js

@@ -1,3 +1,4 @@
+/* global __DEFAULT_ROLLBARJS_HASH__:false */
 /* global __DEFAULT_ROLLBARJS_URL__:false */
 /* global _rollbarConfig:true */
 
@@ -6,6 +7,7 @@ var snippetCallback = require('../snippet_callback');
 
 _rollbarConfig = _rollbarConfig || {};
 _rollbarConfig.rollbarJsUrl = _rollbarConfig.rollbarJsUrl || __DEFAULT_ROLLBARJS_URL__;
+_rollbarConfig.integrity = _rollbarConfig.integrity || __DEFAULT_ROLLBARJS_HASH__;
 _rollbarConfig.async = _rollbarConfig.async === undefined || _rollbarConfig.async;
 
 var shim = Shim.setupShim(window, _rollbarConfig);

src/browser/shim.js

@@ -112,6 +112,9 @@ Shim.prototype.loadFull = function(window, document, immediate, options, callbac
   if (!immediate) {
     s.async = true;
   }
+  if (!options.integrity) {
+    s.integrity = options.integrity;
+  }
 
   s.onload = s.onreadystatechange = _wrapInternalErr(function() {
     if (!done && (!this.readyState || this.readyState === 'loaded' || this.readyState === 'complete')) {

webpack.config.js

@@ -3,6 +3,7 @@ var path = require('path');
 var webpack = require('webpack');
 var defaults = require('./defaults');
 var TerserPlugin = require('terser-webpack-plugin');
+var WebpackAssetsManifest = require('webpack-assets-manifest');
 
 var outputPath = path.resolve(__dirname, 'dist');
 
@@ -12,37 +13,6 @@ var uglifyPlugin = new TerserPlugin({
   parallel: true
 });
 
-var snippetConfig = {
-  name: 'snippet',
-  entry: {
-    'rollbar.snippet': './src/browser/bundles/rollbar.snippet.js'
-  },
-  output: {
-    path: outputPath,
-    filename: '[name].js'
-  },
-  plugins: [defaultsPlugin],
-  module: {
-    rules: [
-      {
-        enforce: 'pre',
-        test: /\.js$/,
-        loader: 'eslint-loader',
-        exclude: [/node_modules/, /vendor/],
-        options: {
-          failOnError: true,
-          configFile: path.resolve(__dirname, '.eslintrc')
-        }
-      },
-      {
-        test: /\.js$/,
-        loader: 'strict-loader',
-        exclude: [/node_modules/, /vendor/]
-      }
-    ],
-  }
-};
-
 var pluginConfig = {
   name: 'plugins',
   entry: {
@@ -150,7 +120,7 @@ namedAMDConfigBase.output.library = 'rollbar';
 namedAMDConfigBase.output.libraryTarget = 'amd';
 
 
-var config = [snippetConfig, pluginConfig];
+var config = [pluginConfig];
 
 function optimizationConfig(minimizer) {
   return {
@@ -159,7 +129,7 @@ function optimizationConfig(minimizer) {
   }
 }
 
-function addVanillaToConfig(webpackConfig, filename, extraPlugins, minimizer) {
+function buildVanillaConfig(filename, extraPlugins, minimizer) {
   var basePlugins = [defaultsPlugin];
   var vanillaConfig = extend({}, vanillaConfigBase);
   vanillaConfig.name = filename;
@@ -171,7 +141,7 @@ function addVanillaToConfig(webpackConfig, filename, extraPlugins, minimizer) {
 
   vanillaConfig.output = extend({filename: filename}, vanillaConfig.output);
 
-  webpackConfig.push(vanillaConfig);
+  return vanillaConfig;
 }
 
 function addUMDToConfig(webpackConfig, filename, extraPlugins, minimizer) {
@@ -220,7 +190,14 @@ function addNamedAMDToConfig(webpackConfig, filename, extraPlugins, minimizer) {
 
 
 function generateBuildConfig(name, plugins, minimizer) {
-  addVanillaToConfig(config, name, plugins, minimizer);
+  config.push(buildVanillaConfig(name, [
+    ...plugins,
+    new WebpackAssetsManifest({
+      integrity: true,
+      integrityHashes: ['sha256'],
+      writeToDisk: true,
+    })
+  ], minimizer));
   addUMDToConfig(config, name, plugins, minimizer);
   addNamedAMDToConfig(config, name, plugins, minimizer);
   addNoConflictToConfig(config, name, plugins, minimizer);

webpack.config.snippet.js

@@ -0,0 +1,64 @@
+var fs = require('fs');
+var path = require('path');
+var webpack = require('webpack');
+var defaults = require('./defaults');
+var webpackConfig = require('./webpack.config.js');
+
+var outputPath = path.resolve(__dirname, 'dist');
+
+var defaultsPlugin = new webpack.DefinePlugin(defaults);
+
+var snippetConfig = {
+  name: 'snippet',
+  entry: {
+    'rollbar.snippet': './src/browser/bundles/rollbar.snippet.js'
+  },
+  output: {
+    path: outputPath,
+    filename: '[name].js'
+  },
+  plugins: [defaultsPlugin],
+  module: {
+    rules: [
+      {
+        enforce: 'pre',
+        test: /\.js$/,
+        loader: 'eslint-loader',
+        exclude: [/node_modules/, /vendor/],
+        options: {
+          failOnError: true,
+          configFile: path.resolve(__dirname, '.eslintrc')
+        }
+      },
+      {
+        test: /\.js$/,
+        loader: 'strict-loader',
+        exclude: [/node_modules/, /vendor/]
+      }
+    ],
+  }
+};
+
+function buildConfig() {
+  var hash
+  try {
+    hash = JSON.parse(
+      fs.readFileSync(path.join(
+        webpackConfig.find(({entry}) => entry.rollbar).output.path, 'manifest.json',
+      )),
+    )['rollbar.js'].integrity;
+  } catch (error) {} // eslint-disable-line no-empty
+
+  return {
+    ...snippetConfig,
+    plugins: [
+      ...snippetConfig.plugins,
+      new webpack.DefinePlugin({
+        __DEFAULT_ROLLBARJS_HASH__: JSON.stringify(hash),
+      }),
+    ],
+  }
+}
+
+
+module.exports = buildConfig;