Commit 33fa50b1 authored by Robert Speicher's avatar Robert Speicher

Merge branch 'sri' into 'master'

Add Subresource Integrity attribute to CSS and JS assets.

This prevents compromised or malicious CDNs from modifying GitLab's assets. The hash provided by Rails is compared to the hash of the asset the browser has downloaded. The browser will refuse to execute/parse the assets if the hashes don't match. SRI is currently implemented in Firefox, Chrome, and Opera.

This doesn't apply to the dynamically-generated per-page JavaScript due to [a bug in sprockets-rails](https://github.com/rails/sprockets-rails/issues/359). Unfortunately until there's a fix available we won't benefit fully from a security perspective.

It's more secure. More information is available in #18230 and on MDN:
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Fixes #18230

See merge request !4808
parents cef02191 bba1d2de
...@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date. ...@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date.
v 8.10.0 (unreleased) v 8.10.0 (unreleased)
- Wrap code blocks on Activies and Todos page. !4783 (winniehell) - Wrap code blocks on Activies and Todos page. !4783 (winniehell)
- Fix MR-auto-close text added to description. !4836 - Fix MR-auto-close text added to description. !4836
- Implement Subresource Integrity for CSS and JavaScript assets. This prevents malicious assets from loading in the case of a CDN compromise.
v 8.9.0 v 8.9.0
- Fix builds API response not including commit data - Fix builds API response not including commit data
......
...@@ -25,11 +25,14 @@ ...@@ -25,11 +25,14 @@
= favicon_link_tag 'favicon.ico' = favicon_link_tag 'favicon.ico'
= stylesheet_link_tag "application", media: "all" = stylesheet_link_tag "application", media: "all", integrity: true
= stylesheet_link_tag "print", media: "print" = stylesheet_link_tag "print", media: "print", integrity: true
= javascript_include_tag "application" = javascript_include_tag "application", integrity: true
-# FIXME: SRI doesn't apply to the dynamically-generated per-page
-# JavaScript due to a bug in sprockets-rails.
-# See https://github.com/rails/sprockets-rails/issues/359
- if page_specific_javascripts - if page_specific_javascripts
= javascript_include_tag page_specific_javascripts, {"data-turbolinks-track" => true} = javascript_include_tag page_specific_javascripts, {"data-turbolinks-track" => true}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment