Invalid Sub-Resource Integrity values detected

Description

JavaScript or CSS source files were found to contain invalid Sub-Resource Integrity (SRI) integrity values or a missing crossorigin value. These scripts or links should be investigated to ensure they have not been maliciously altered. If in doubt, contact the owner of the scripts or replace them with known good versions.

Remediation

All identified resources should be sourced from the same domain as the target application. If this is not possible, it is strongly recommended that all script tags that implement src values, or link tags that implement the href values include Sub-Resource Integrity. To generate SRI integrity values the srihash tool can be used, or by running one of the following commands:

• cat FILENAME.js | openssl dgst -sha384 -binary | openssl base64 -A
• shasum -b -a 384 FILENAME.js | awk '{ print $1 }' | xxd -r -p | base64

The output of these tools must be added as additional attributes, in particular: integrity and either crossorigin=anonymous or crossorigin=use-credentials. An example of a valid SRI protected script tag can be found below:

<script src="https://example.com/example-framework.js"
    integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
    crossorigin="anonymous"></script>

Details

Links

• OWASP
• CWE
• MDN