Forums / Reports of Security Problems / SRi hash tags for jscript pages

SRi hash tags for jscript pages

Views: 31

Results 1 to 2 of 2
30 Jun 2019, 2:27 AM
#1
noppie avatar

noppie

Zen Follower

Join Date:
Mar 2004
Posts:
210
Plugin Contributions:
0

SRi hash tags for jscript pages

Hello,
i understand this is a private post page

i am trying to get my zencart secure.
i ran a security check for tinfoil and i got this below.. but before i paste it I am starting to understand what i need to do...
so i need to generate a SRI hash code for my jscripts
and i am just not sure how to do that,.
I didn't know where else to put this post.

i know i have to to put it in the java script files under template.
but when i put in that address it comes back with no result.

ok here is what i got from the security place
tinfoil

VULNERABILITY: MISSING SUBRESOURCE INTEGRITY PROTECTION
DETAILS
Severity
URL
Variable
Element
Low
https://herasonlinemarket.com/shop/
https://maxcdn.bootstrapcdn.com/font-
awesome/4.7.0/css/font-awesome.min.css
body
DESCRIPTION
By loading non-integrity protected resources from an external server or CDN, it becomes possible for
an attacker to compromise that server, in order to serve your users malicious resources. This opens
you up to the possibility of cross-site scripting attacks, or other, similar vulnerabilities.
HOW TO FIX
All externally loaded resources must have their content pinned using the subresource integrity
mechanisms provided by modern browsers. This involves computing a hash of the contents of the
resource, and specifying this hash when loading that resource. In the case of a script, this might look
like the following:

<script src="https://example.com/include.js" integrity="sha256-Rj/9XDU7F6pNSX8yBddiCIIS+XKDTtdq0//No0MH0AE=" crossorigin="anonymous"> </script>

SRI Hash is an option for computing the necessary hashes.
REFERENCES
SRI Hash - https://srihash.org/
W3 - Subresource Integrity - http://www.w3.org/TR/SRI/
Github - Subresource Integrity - http://githubengineering.com/subresource-integrity/

My Multi_Site Zen Carts
http://herasonlinemarket.com

4 Jul 2019, 6:56 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: SRi hash tags for jscript pages

You can update the code in your template and/or plugins to add the sri hash for each external css or js that you load.
To do that you would find those spots in your template, go to the 3rd-party service's site to find the sri hash, and then put it into your template. Or plugin.

That external scanner you've quoted from mentioned fontawesome being one. So, go to the font-awesome website, get their sri code for the version of fontawesome you're using, and update your template accordingly.

Since every template and plugin is different it's not practical for us to list every possible combination here.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.