Feature: Introduce subresource integrity checks (SRI) for frontend assets (#100983)

* feat(featuremgmt): introduce feature toggle for enabling sri checks

* feat(frontend): use assetSriChecks feature toggle to inject integrity hash into script tags

* chore(webpack): align sri algorithms across dev and prod builds

* docs(featuremgmt): update assetSriChecks to pass CI

* docs(featuremgmt): fix more spelling complaints with assetSriChecks

* Add crossorigin attribute

* chore(webpack): add subresource-integrity plugin

* build(webpack): wrap webpack jsonp loader integrity checks in feature flag checks

* revert(index.html): remove crossorigin attribute if assertSriChecks is disabled

---------

Co-authored-by: Kristian Bremberg <kristian.bremberg@grafana.com>

This commit is contained in:

Jack Westbrook

2025-03-04 11:56:35 +01:00

committed by

GitHub

co-authored by

Kristian Bremberg

parent bf9a34f2ca

commit bbfeb8d220

13 changed files with 141 additions and 7 deletions

									
										packages/grafana-data/src/types/featureToggles.gen.ts
									
		+1
		
												View File
												
				@@ -254,4 +254,5 @@ export interface FeatureToggles {

				  alertingRuleVersionHistoryRestore?: boolean;

				  newShareReportDrawer?: boolean;

				  rendererDisableAppPluginsPreload?: boolean;

				  assetSriChecks?: boolean;

				}