Fucory
@fucory
Did a PR to gnosis safe UI to add missing SRI protection https://github.com/safe-global/safe-wallet-monorepo/pull/5186/files For those not in loop SRI tells the browser to not load javascript files that don't match an integrity hash https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity All bundlers support this with plugins
2 replies
1 recast
17 reactions
polymutex
@polymutex.eth
Still seems not super useful so long as the top-level page itself isn't integrity-verifiable... Especially if all these bundles are served from the same server.
2 replies
0 recast
1 reaction
Fucory
@fucory
Ideally in a web settings you make the assets including html get cached by service worker so the user has to opt into upgrades. More ideally is what Tevm App will do which is putting the root html hash on chain
0 reply
0 recast
1 reaction
v1rtl
@v1rtl.eth
I think this is mostly useful for ensuring that third party scripts keep the integrity probably not as useful for local ones
1 reply
0 recast
0 reaction