-
Notifications
You must be signed in to change notification settings - Fork 44
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: loader missing sub-resource integrity hashes (#837)
- Loading branch information
1 parent
3e3b810
commit a9b6f2e
Showing
15 changed files
with
411 additions
and
238 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| { | ||
| "lastUpdated": "Thu Nov 16 2023 17:54:23 GMT+0000 (Coordinated Universal Time)", | ||
| "lastUpdated": "Tue Dec 12 2023 10:40:55 GMT-0600 (Central Standard Time)", | ||
| "projectName": "New Relic Browser Agent", | ||
| "projectUrl": "https://github.com/newrelic/newrelic-browser-agent", | ||
| "includeOptDeps": true, | ||
|
|
@@ -1060,19 +1060,6 @@ | |
| "email": "[email protected]", | ||
| "url": "http://dontkry.com" | ||
| }, | ||
| "[email protected]": { | ||
| "name": "webpack-subresource-integrity", | ||
| "version": "5.1.0", | ||
| "range": "^5.1.0", | ||
| "licenses": "MIT", | ||
| "repoUrl": "https://github.com/waysact/webpack-subresource-integrity", | ||
| "versionedRepoUrl": "https://github.com/waysact/webpack-subresource-integrity/tree/v5.1.0", | ||
| "licenseFile": "node_modules/webpack-subresource-integrity/LICENSE", | ||
| "licenseUrl": "https://github.com/waysact/webpack-subresource-integrity/blob/v5.1.0/LICENSE", | ||
| "licenseTextSource": "file", | ||
| "publisher": "Julian Scheid", | ||
| "email": "[email protected]" | ||
| }, | ||
| "[email protected]": { | ||
| "name": "webpack", | ||
| "version": "5.84.1", | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| import fs from 'node:fs' | ||
| import path from 'node:path' | ||
|
|
||
| /** | ||
| * Webpack plugin that generates fuzzy version matching loader files | ||
| * after a compilation has emitted its files. This will only apply | ||
| * when the loader files name contains a properly formatted semver. | ||
| */ | ||
| export default class NRBAFuzzyLoadersPlugin { | ||
| #pluginName = 'NRBAFuzzyLoadersPlugin' | ||
|
|
||
| /** | ||
| * @param compiler {import('webpack/lib/Compiler.js').default} | ||
| */ | ||
| apply (compiler) { | ||
| compiler.hooks.assetEmitted.tapPromise(this.#pluginName, async (file, { content, outputPath }) => { | ||
| await this.#writeFuzzyMinor(file, outputPath, content) | ||
| await this.#writeFuzzyMajor(file, outputPath, content) | ||
| }) | ||
| } | ||
|
|
||
| /** | ||
| * If the file is a loader with a version number, write a new file using | ||
| * the same name with the third version octet replaced with an x as a wildcard. | ||
| * @param file {string} | ||
| * @param outputPath {string} | ||
| * @param content {string | Buffer} | ||
| * @return {Promise<void>} | ||
| */ | ||
| async #writeFuzzyMinor (file, outputPath, content) { | ||
| // Assuming the filename contains a semantic version pattern, "-#.#.#.", replace the minor and patch numbers. | ||
| const allPatch = file.replace(/(^nr-loader.*-\d+\.\d+\.)(\d+)(.*\.js$)/, '$1x$3') | ||
| if (allPatch !== file) { // we only get a different string back if the filename has that pattern, in which case we'll create the respective "fuzzy" file | ||
| await fs.promises.writeFile(path.join(outputPath, allPatch), content) | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * If the file is a loader with a version number, write a new file using | ||
| * the same name with the second and third version octets replaced with | ||
| * an x as a wildcard. | ||
| * @param file {string} | ||
| * @param outputPath {string} | ||
| * @param content {string | Buffer} | ||
| * @return {Promise<void>} | ||
| */ | ||
| async #writeFuzzyMajor (file, outputPath, content) { | ||
| // Assuming the filename contains a semantic version pattern, "-#.#.#.", replace the minor and patch numbers. | ||
| const allMinorAndPatch = file.replace(/(^nr-loader.*-\d+\.)(\d+)\.(\d+)(.*\.js$)/, '$1x.x$4') | ||
| if (allMinorAndPatch !== file) { // we only get a different string back if the filename has that pattern, in which case we'll create the respective "fuzzy" file | ||
| await fs.promises.writeFile(path.join(outputPath, allMinorAndPatch), content) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| /** | ||
| * Webpack plugin that checks loader files for any character sequences | ||
| * that are known to break APM injection. If found, an error is registered | ||
| * in the compilation and the compilation process will end with a non-zero | ||
| * status code. | ||
| */ | ||
| export default class NRBALoaderApmCheckPlugin { | ||
| #pluginName = 'NRBALoaderApmCheckPlugin' | ||
|
|
||
| /** | ||
| * @param compiler {import('webpack/lib/Compiler.js').default} | ||
| */ | ||
| apply (compiler) { | ||
| compiler.hooks.thisCompilation.tap(this.#pluginName, (compilation) => { | ||
| compilation.hooks.processAssets.tap( | ||
| { | ||
| name: this.#pluginName, | ||
| stage: compilation.compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE + 1, | ||
| additionalAssets: true | ||
| }, | ||
| (assets) => { | ||
| Object.entries(assets) | ||
| .filter(([assetKey]) => assetKey.indexOf('-loader') > -1 && assetKey.endsWith('.js')) | ||
| .forEach(([assetKey, assetSource]) => { | ||
| let source = assetSource.source() | ||
|
|
||
| if (typeof source !== 'string') { | ||
| source = source.toString('utf-8') | ||
| } | ||
|
|
||
| const matches = Array.from(source.matchAll(/\$&/g)) | ||
| for (const match of matches) { | ||
| const error = new compilation.compiler.webpack.WebpackError(`Character sequence known to break APM injection detected: ${match[0]}`) | ||
| error.file = assetKey | ||
| compilation.errors.push(error) | ||
| } | ||
| }) | ||
| } | ||
| ) | ||
| }) | ||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.