guide icon indicating copy to clipboard operation
guide copied to clipboard

Pin dependencies and add integrity checks

Open ewan-escience opened this issue 5 months ago • 0 comments

Linked dependencies, as in <script src="//cdn.jsdelivr.net/npm/docsify/lib/plugins/search.min.js"></script> don't have a version in their URL, meaning they will always point to the latest version. (Side note: why do these dependencies start with // instead of https://?). This has two risks:

  1. A new version might break the guide (through a bug or a changed API)
  2. A version with malicious code might be used

If you take off the last part of the path of these dependcies (e.g. https://cdn.jsdelivr.net/npm/docsify/lib/plugins/), you can navigate through the versions.

Furthermore, we should use integrity checks to ensure that the loaded code has not been altered with.

ewan-escience avatar Sep 27 '24 13:09 ewan-escience