From: Ardis Lu <ardisglu@gmail.com>
Date: Fri, 25 Sep 2026 05:31:38 +0000 (-0700)
Subject: Add SRI to template script
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=bdf9f7273832bdabee6ee425500daed52ccc0ce3;p=static-encrypt

Add SRI to template script
---

diff --git a/index.html b/index.html
index c41bfa6..72d6460 100644
--- a/index.html
+++ b/index.html
@@ -255,12 +255,13 @@
       setTimeout(() => copyButton.style.setProperty('--display', 'none'), 2500);
     })
 
-    document.querySelector('#download').addEventListener('click', e => {
+    document.querySelector('#download').addEventListener('click', async e => {
       e.preventDefault();
       const encrypted = document.querySelector('#ciphertext').textContent;
       const script = template.match(/<script.*>([\s\S]*)<\/script>/i)?.[1];
       const injectedScript = `const content = '${encrypted}'; ${decrypt.toString()} ${script}`;
-      const output = template.replace(/(<script.*)>[\s\S]*<\/script>/i, `$1>${injectedScript}<\/script>`);
+      const scriptHash = new Uint8Array(await crypto.subtle.digest('SHA-512', new TextEncoder().encode(injectedScript))).toBase64();
+      const output = template.replace(/(<script.*)>[\s\S]*<\/script>/i, `$1 integrity="sha512-${scriptHash}">${injectedScript}<\/script>`);
       downloadHtml(output, `${Date.now()}.html`);
     })