Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: loader missing sub-resource integrity hashes #837

Merged
merged 4 commits into from
Dec 14, 2023
Merged

Conversation

patrickhousley
Copy link
Contributor

Sub-resource integrity hashes were not being properly generated and included in the loader for async chunks related to session replay. This would cause a warning to appear in the browser console but would not block those chunks from loading. This would have only affected customers taking part in the session replay limited preview.

Overview

This problem was caused by a couple of issues:

  1. The webpack plugin that we relied on to generate the SRI hashes was not picking up the recorder and compressor chunks so no hash was being generated.
  2. We had post build scripts that modified the files after the webpack build finished. While this issue was not seen before, it would have been if we did not move those processes internal to webpack after fixing the SRI hash generation.

Change Highlights:

  • Moved all the post build scripts into individual webpack plugins.
  • Wrote a new SRI plugin that correctly generates and injects hashes for all async chunks.
    • While this plugin does not have nearly as much functionality as the original, it does work for our needs and I doubt we will ever need the additional functionality around HMR and the HTML plugin.

Related Issue(s)

https://new-relic.atlassian.net/browse/NR-189746

Testing

The SRI integration test has been updated to force session replay and verify all chunks were loaded with integrity hashes.

Copy link

Asset Size Report

Merging this pull request will result in the following asset size changes:

Agent Asset Previous Size New Size Diff
lite loader 30.39 kB / 10.55 kB (gzip) 30.36 kB / 10.54 kB (gzip) -0.1% / -0.02% (gzip)
lite async-chunk 45.58 kB / 15.05 kB (gzip) 45.58 kB / 15.05 kB (gzip) 0% / 0% (gzip)
pro loader 47.79 kB / 15.97 kB (gzip) 47.96 kB / 16.15 kB (gzip) 0.36% / 1.15% (gzip)
pro async-chunk 74.48 kB / 23.75 kB (gzip) 74.48 kB / 23.75 kB (gzip) 0% / 0% (gzip)
spa loader 54.24 kB / 17.95 kB (gzip) 54.42 kB / 18.13 kB (gzip) 0.32% / 1.02% (gzip)
spa async-chunk 89.25 kB / 28.16 kB (gzip) 89.25 kB / 28.16 kB (gzip) 0% / 0% (gzip)
lite-polyfills loader 122.23 kB / 39.63 kB (gzip) 122.19 kB / 39.6 kB (gzip) -0.04% / -0.09% (gzip)
lite-polyfills async-chunk 57.97 kB / 17.25 kB (gzip) 57.97 kB / 17.25 kB (gzip) 0% / 0% (gzip)
pro-polyfills loader 141.79 kB / 45.4 kB (gzip) 141.75 kB / 45.36 kB (gzip) -0.03% / -0.08% (gzip)
pro-polyfills async-chunk 101.74 kB / 27.34 kB (gzip) 101.74 kB / 27.34 kB (gzip) 0% / 0% (gzip)
spa-polyfills loader 149.81 kB / 47.54 kB (gzip) 149.77 kB / 47.5 kB (gzip) -0.03% / -0.08% (gzip)
spa-polyfills async-chunk 117.31 kB / 31.93 kB (gzip) 117.31 kB / 31.93 kB (gzip) 0% / 0% (gzip)

Copy link

github-actions bot commented Dec 13, 2023

Static Badge

Last ran on December 14, 2023 09:37:03 CST
Checking merge of (b0dc65a) into main (3e3b810)

Copy link

codecov bot commented Dec 13, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (3e3b810) 78.24% compared to head (b0dc65a) 78.24%.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #837   +/-   ##
=======================================
  Coverage   78.24%   78.24%           
=======================================
  Files         142      142           
  Lines        6358     6358           
  Branches     1228     1228           
=======================================
  Hits         4975     4975           
  Misses       1176     1176           
  Partials      207      207           
Flag Coverage Δ
integration-tests 88.26% <ø> (ø)
unit-tests 55.10% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

tests/specs/csp.e2e.js Outdated Show resolved Hide resolved
tests/specs/csp.e2e.js Outdated Show resolved Hide resolved
Copy link
Contributor

@cwli24 cwli24 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Built & confirmed each plugins is doing its work.

@patrickhousley patrickhousley merged commit a9b6f2e into main Dec 14, 2023
47 of 51 checks passed
@patrickhousley patrickhousley deleted the fix-sri branch December 14, 2023 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants