This repository was archived by the owner on Nov 4, 2024. It is now read-only.
This repository was archived by the owner on Nov 4, 2024. It is now read-only.
Subresource Integrity warning for scripts with data-uri #455
Open
Description
I get this warning: "Subresource Integrity (SRI) not implemented, and external scripts are loaded over HTTP or use protocol-relative URLs via src="//...", even though the only script on my page is:
<script src="data:text/javascript;base64,YWxlcnQoMSkK" type=text/javascript></script>
This is the website I tested it on: https://observatory.mozilla.org/analyze/exyi.cz
I don't want to stop using the base64 inline scripts - it allows them to have defer
attribute and provides less opportunities for exploitation JSON encoded data in the script by injecting </script>
in a string
Metadata
Metadata
Assignees
Labels
No labels