Security finding
A script is not the file its tag, its address or the last crawl says it is
Security Warning Severity: Medium
Part of the audit Script integrity and versions do not match what loads. Finding id: security.scriptIntegrityConflicts.
What it costs you
A script from another host runs with full access to your pages. When that file changes without you changing anything, you are running code nobody on your side reviewed.
What to do
Load third-party scripts by exact version with an integrity hash, or host them yourself. Check each unexplained change against the vendor's release notes.
What it checks
- Script integrity hash does not match
- Floating latest URL changed since last crawl
- Different library versions on different pages
- Version in filename differs from content
- Third-party script changed without site change
How to fix it
Check the file, then update the hash
- Download [subject] and compare it with the vendor's release.
- If it is the file you want, compute the new hash and put it in the integrity attribute: cat FILENAME.js | openssl dgst -sha384 -binary | openssl base64 -A
- If it is not, remove the tag until you know why the file changed.
How to check: Open [example url] with the browser console open: no integrity error.
Compare the changed file with the vendor's release
- Compare [subject] with the file the vendor published for that version, and read the release notes.
- If they differ, remove the tag until you know why.
- Then pin it with an integrity hash, so the browser refuses the next change.
How to check: Recrawl: no changed hashes.
Load one version everywhere
- Find the template that loads the other version ([detail]) and update it.
- Name each file after the version it holds.
How to check: Recrawl: one version per library.
Pin the version and add the hash
- Replace the floating address with the address of an exact version.
- Compute the hash of that file: cat FILENAME.js | openssl dgst -sha384 -binary | openssl base64 -A
How to check: Open [example url] with the browser console open: no integrity error. Recrawl: no changed hashes.
A real case
In February 2018 a text-to-speech script that more than 4,000 websites loaded from its supplier was altered to mine cryptocurrency in visitors' browsers for about four hours. The sites included NHS trusts, local councils and the UK data protection regulator, whose website was taken down.
How to verify by hand
The vendor's release notes.
What this relies on
A third-party file that changes without the site changing needs a look.