fix: add Subresource Integrity hashes for CDN-loaded Leaflet plugins - #606
Open
pipe0919 wants to merge 92 commits into
Open
fix: add Subresource Integrity hashes for CDN-loaded Leaflet plugins#606pipe0919 wants to merge 92 commits into
pipe0919 wants to merge 92 commits into
Conversation
* fix bug when setIconMarker in web liodali#560
* remove unnecessary dependency in android
…y different platoform
Add script to automate publishing process for flutter_osm_interface and flutter_osm_web packages
- Remove redundant async/await in simple getter methods - Improve code readability by reducing line length
- Upgrade com.android.application plugin to 8.12.0 - Update gradle wrapper to 8.13 - Bump Java compatibility to version 17 - Adjust minSdk to 30 and targetSdk to BAKLAVA
- Update Android Gradle plugin to 8.12.1 - Bump compileSdk to 36 - Upgrade Retrofit to 3.0.0 - Update Kotlin coroutines to 1.10.2 - Enable minification and resource shrinking for release builds - Set JVM target to version 17
Add Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy meta tags to enhance security and prevent potential cross-origin issues
Change COEP and COOP headers to improve security and compatibility
Ensure proper cross-origin resource sharing by including the missing CORP meta tag
add package_info_plus and dio dependencies to fetch map assets from GitHub CDN modify WebOsmController to accept HTML content as parameter update Cross-Origin-Embedder-Policy to credentialless
Clean up commented out code and unused imports related to package info and CDN version handling that are no longer needed
Enable web support by adding required flutter_web_plugins dependency and configuring URL strategy
The map.html WebView loads two Leaflet plugin scripts from cdn.jsdelivr.net without integrity attributes: - leaflet-rotatedmarker@0.2.0 - leaflet-hotline@0.4.0 The two Leaflet core files from unpkg.com already include correct SRI hashes. This commit adds SHA-384 integrity hashes and crossorigin attributes to the two plugin script tags, matching the pattern already used by the Leaflet core includes. Without SRI, a CDN compromise or man-in-the-middle substitution would execute unvalidated JavaScript in the map WebView context. References: - CWE-353: Missing Support for Integrity Check - https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
Owner
|
your pr contain other staff can you make new one with just cdn fixes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
integrityandcrossoriginattributes to two CDN-loaded Leaflet plugin scripts influtter_osm_web/lib/src/asset/map.htmlProblem
The
map.htmlWebView loads four external scripts. The two Leaflet core files fromunpkg.comalready include SRI integrity hashes:However, the two plugin scripts from
cdn.jsdelivr.netdo not:Without Subresource Integrity (SRI) hashes, a CDN-side compromise or substitution would execute unvalidated JavaScript in the map WebView context.
Changes
Added
integrity="sha384-..."andcrossorigin=""attributes to both plugin script tags, matching the pattern used by the existing Leaflet core includes.References:
Test plan