feat: add possibility for security SRI/integrity attribute · stenciljs/core#6132

Métriques du dépôt

I have read the Contributing Guidelines.
I agree to follow the Code of Conduct.
I have searched for existing issues that already include this feature request, without success.

If providing stencil component files via a CDN its recommended to load them with an integrity attribute: https://www.w3schools.com/tags/att_script_integrity.asp

This is easily possible for stencil's loader file. But this file loads other scripts without the possibility of adding a integrity hash.

A big design system is providing stencil components via a CDN and consumers wanted to use this security technique.

consumer just needs to add the SRI "manually" to the loader file request (consumer know the hash)
loading of all other files could be extended by the hashes of each file by stencil internal loading logic
those hashes could be generated at build time and baked into the loader file (because the browser can trust the value of the loader file)

There are a lot of alternatives. Maybe the consumer can create itself the hashes of loaded files and provide them to the stencil loader.

No response

No response

Direction de recherche: Examinez le code de génération du chargeur Stencil pour trouver où les URL des scripts sont émises, puis ajoutez la prise en charge optionnelle de l'attribut integrity en calculant les hachages au moment de la construction et en les intégrant dans le chargeur.
Stack technique: typescript
Domaine: frontend
Type d'issue: Fonctionnalité
Difficulté: 3
Temps estimé: 1-2 jours
Statut d'activité: Active
Clarté: Claire
Prérequis: TypeScriptStencil build processWeb security
Accessibilité débutant: 40