Add SRI to template script

diff --git a/index.html b/index.html
index c41bfa6eb9ac6a1804e3599e66d8199dac7fbcdf..72d6460fa550e61963f66ed6ae38811ba67e1137 100644 (file)
--- a/index.html
+++ b/index.html
@@ -255,12 +255,13 @@
       setTimeout(() => copyButton.style.setProperty('--display', 'none'), 2500);
     })
 
-    document.querySelector('#download').addEventListener('click', e => {
+    document.querySelector('#download').addEventListener('click', async e => {
       e.preventDefault();
       const encrypted = document.querySelector('#ciphertext').textContent;
       const script = template.match(/<script.*>([\s\S]*)<\/script>/i)?.[1];
       const injectedScript = `const content = '${encrypted}'; ${decrypt.toString()} ${script}`;
-      const output = template.replace(/(<script.*)>[\s\S]*<\/script>/i, `$1>${injectedScript}<\/script>`);
+      const scriptHash = new Uint8Array(await crypto.subtle.digest('SHA-512', new TextEncoder().encode(injectedScript))).toBase64();
+      const output = template.replace(/(<script.*)>[\s\S]*<\/script>/i, `$1 integrity="sha512-${scriptHash}">${injectedScript}<\/script>`);
       downloadHtml(output, `${Date.now()}.html`);
     })