1945540 - Implement importmap integrity verification

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P3)

Description

[Fatih Kilic [:fkilic]]

This bug aims to track the implementation of https://github.com/mozilla/standards-positions/issues/1010

Comment 1

[Fatih Kilic [:fkilic]]

Attachment: Bug 1945540: Part 3 - Get integrity from import map. r?jonco,tschuster

This patch does two things. First one is, it checks for the existence of "integrity" property in the script tag and drills down that value, and the second one is it implements loading of integrity values from the ImportMap and adds the SRI metadata to script load requests.

Comment 2

[Fatih Kilic [:fkilic]]

Attachment: Bug 1945540: Enable WPT tests. r?tschuster

Comment 4

[Fatih Kilic [:fkilic]]

Attachment: Bug 1945540: Part 1 - Implement parsing of integrity field. r?tschuster,jonco

Comment 5

[Fatih Kilic [:fkilic]]

Attachment: Bug 1945540: Part 2 - Make integrity VoidString if no integrity attribute was provided. r?jonco,tschuster

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/083f906721f4
Part 1 - Implement parsing of integrity field. r=tschuster,jonco
https://hg.mozilla.org/integration/autoland/rev/de72c7441c29
Part 2 - Make integrity VoidString if no integrity attribute was provided. r=tschuster
https://hg.mozilla.org/integration/autoland/rev/690179550da9
Part 3 - Get integrity from import map. r=tschuster,jonco,dom-core,mccr8
https://hg.mozilla.org/integration/autoland/rev/c9a2c8a3f840
Enable WPT tests. r=tschuster

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/083f906721f4
https://hg.mozilla.org/mozilla-central/rev/de72c7441c29
https://hg.mozilla.org/mozilla-central/rev/690179550da9
https://hg.mozilla.org/mozilla-central/rev/c9a2c8a3f840

Comment 8

[Fatih Kilic [:fkilic]]

Release Note Request (optional, but appreciated)
[Why is this notable]: We now support importmap integrity verification. I think it is important for devs.
[Affects Firefox for Android]: Yes (not the UI, but affects the engine)
[Suggested wording]: Added support for import map integrity field. You can now ensure the integrity of dynamically or statically imported modules.
[Links (documentation, blog post, etc)]: Previous notes for import map's introduction https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/108#apis, and import map integrity description on MDNN https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script/type/importmap#integrity_metadata_map

Comment 9

[Dianna Smith [:diannaS]]

Added to the 138 beta notes and will include in the final release notes.

Comment 10

[Dave Letorey]

Related issues and pull requests

• BCD PR
• Firefox release PR