From 3be0e8474d2149471293ef1aaa30a4d2dbb1d43b Mon Sep 17 00:00:00 2001
From: "E. S." <the@rootless.one>
Date: Wed, 13 Mar 2024 01:27:35 +0000
Subject: [PATCH] config-static: support integrity

---
 deploy/gen_static_config.php | 13 +++++++++----
 engine/skin.php              |  2 ++
 skin/base.phps               | 13 ++++++++++---
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/deploy/gen_static_config.php b/deploy/gen_static_config.php
index f83c547..dca6f87 100755
--- a/deploy/gen_static_config.php
+++ b/deploy/gen_static_config.php
@@ -1,9 +1,8 @@
 #!/usr/bin/env php
 <?php
 
-use util\cli;
-
 require __DIR__.'/../init.php';
+require 'engine/skin.php';
 
 if ($argc <= 1) {
     usage();
@@ -36,8 +35,14 @@ foreach (['css', 'js'] as $type) {
         continue;
     }
 
-    foreach ($entries as $file)
-        $hashes[$type.'/'.basename($file)] = get_hash($file);
+    foreach ($entries as $file) {
+        $hashes[$type.'/'.basename($file)] = [
+            'version' => get_hash($file),
+            'integrity' => []
+        ];
+        foreach (RESOURCE_INTEGRITY_HASHES as $hash_type)
+            $hashes[$type.'/'.basename($file)]['integrity'][$hash_type] = base64_encode(hash_file($hash_type, $file, true));
+    }
 }
 
 echo "<?php\n\n";
diff --git a/engine/skin.php b/engine/skin.php
index ec3f545..d12a98e 100644
--- a/engine/skin.php
+++ b/engine/skin.php
@@ -2,6 +2,8 @@
 
 require_once 'lib/themes.php';
 
+const RESOURCE_INTEGRITY_HASHES = ['sha256', 'sha384', 'sha512'];
+
 $SkinState = new class {
     public array $lang = [];
     public string $title = 'title';
diff --git a/skin/base.phps b/skin/base.phps
index 03f68b5..f03e135 100644
--- a/skin/base.phps
+++ b/skin/base.phps
@@ -146,7 +146,7 @@ function jsLink(string $name): string {
     } else {
         $href = '/dist-js/'.$bname.'.js?'.getStaticVersion($name);
     }
-    return '<script src="'.$href.'" type="text/javascript"></script>';
+    return '<script src="'.$href.'" type="text/javascript"'.getStaticIntegrityAttribute($name).'></script>';
 }
 
 function cssLink(string $name, string $theme, &$bname = null): string {
@@ -165,7 +165,7 @@ function cssLink(string $name, string $theme, &$bname = null): string {
     if ($theme == 'dark')
         $id .= '_dark';
 
-    return '<link rel="stylesheet" id="'.$id.'" type="text/css" href="'.$href.'">';
+    return '<link rel="stylesheet" id="'.$id.'" type="text/css" href="'.$href.'"'.getStaticIntegrityAttribute($name).'>';
 }
 
 function cssPrefetchLink(string $name): string {
@@ -195,7 +195,14 @@ function getStaticVersion(string $name): string {
         logWarning(__FUNCTION__.': '.$name.' starts with /');
         $name = substr($name, 1);
     }
-    return $config['static'][$name] ?? 'notfound';
+    return $config['static'][$name]['version'] ?? 'notfound';
+}
+
+function getStaticIntegrityAttribute(string $name): string {
+    if (is_dev())
+        return '';
+    global $config;
+    return ' integrity="'.implode(' ', array_map(fn($hash_type) => $hash_type.'-'.$config['static'][$name]['integrity'][$hash_type], RESOURCE_INTEGRITY_HASHES)).'"';
 }