feat: add possibility for security SRI/integrity attribute · stenciljs/core#6132

Métricas do repositório

I have read the Contributing Guidelines.
I agree to follow the Code of Conduct.
I have searched for existing issues that already include this feature request, without success.

If providing stencil component files via a CDN its recommended to load them with an integrity attribute: https://www.w3schools.com/tags/att_script_integrity.asp

This is easily possible for stencil's loader file. But this file loads other scripts without the possibility of adding a integrity hash.

A big design system is providing stencil components via a CDN and consumers wanted to use this security technique.

consumer just needs to add the SRI "manually" to the loader file request (consumer know the hash)
loading of all other files could be extended by the hashes of each file by stencil internal loading logic
those hashes could be generated at build time and baked into the loader file (because the browser can trust the value of the loader file)

There are a lot of alternatives. Maybe the consumer can create itself the hashes of loaded files and provide them to the stencil loader.

No response

No response

Direção de pesquisa: Investigue o código de geração do loader do Stencil para encontrar onde os URLs dos scripts são emitidos, depois adicione suporte opcional para o atributo de integridade calculando hashes no momento da build e incorporando os no loader.
Pilha de tecnologia: typescript
Domain: frontend
Tipo Issue: Funcionalidade
Difficulty: 3
Tempo estimado: 1-2 dias
Status da atividade: Ativo
Clarity: Claro
Prerequisites: TypeScriptStencil build processWeb security
Simpatia para novatos: 40