Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Editorial: change style of preload integrity metadata test #10924

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+5 −4
Open

Editorial: change style of preload integrity metadata test #10924

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd567c7
Editorial: change style of preload integrity metadata test
domenic Jan 17, 2025
cc3fe5f
Fix no-SRI case. No longer editorial, now integration fix.
domenic Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27686,14 +27686,15 @@ document.body.appendChild(wbr);</code></pre>
<span data-x="preload integrity metadata">integrity metadata</span>.</p></li>

<li>
<p>If none of the following conditions apply:</p>
<p>If all of the following are true:</p>

<ul>
<li><p><var>consumerIntegrityMetadata</var> is <code data-x="">no metadata</code>;</p></li>
<li><p><var>consumerIntegrityMetadata</var> is not <span data-x="list is empty">empty</span>;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably have quotes?

Though then I looked at https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata and I no longer understand how this even works. I guess SRI changed underneath us or am I missing something?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great catch. I think it's straightforward to fix, so I pushed something. I'll be sure to update the commit message when merging.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Presumably this should use "map is empty"?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, an integrity metadata is now a set of maps, so it's comparing the sets.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh right, why don't they store it as algorithm -> value? Weird.

and</p></li>

<li>
<p><var>consumerIntegrityMetadata</var> is equal to <var>preloadIntegrityMetadata</var>;
or</p>
<p><var>consumerIntegrityMetadata</var> is not equal to
<var>preloadIntegrityMetadata</var></p>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So this compares the maps? Feels a little sketchy to do that this way, but note that with this new style of parsing the XXX below is resolved as we do now ignore unknown integrity options. Not sure that is tested however and I would also be surprised if it matches implementations.

cc @noamr

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah fair, this should probably use "not deeply equal" (without linking to anything, since we haven't defined that).


<p class="XXX">This comparison would ignore unknown integrity options. See <a
href="https://github.com/w3c/webappsec-subresource-integrity/issues/116">issue #116.</a></p>
Expand Down