CHECKOUT-8519: Load scripts with integrity hashes to meet PCI4 requirements #2020
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
davidchin
force-pushed
the
integrity_hash
branch
from
689e2ed
to
795dbd9
Compare
animesh1987
reviewed
Sep 26, 2024
| @@ -32,6 +36,7 @@ const BABEL_PRESET_ENV_CONFIG = { | |||
| useBuiltIns: 'usage', | |||
| modules: false, | |||
| }; | |||
| const PRELOAD_ASSETS = ['billing', 'shipping', 'payment']; | |||
There was a problem hiding this comment.
What does this do? Does it mean we now load assets before we actually get on the step?
There was a problem hiding this comment.
@animesh1987 We used to preload all assets listed in the dynamicChunks section of manifest.json. However, as manifest.json now includes the dynamic chunks for loader.js, which contains translation JSON files in various languages (e.g., translations-es-1.525.0.js), we need to limit preloading to only the necessary ones (billing, shipping and payment).
animesh1987
approved these changes
Sep 26, 2024
richapatel1510
approved these changes
Sep 26, 2024
bc-peng
approved these changes
Sep 26, 2024
davidchin
force-pushed
the
integrity_hash
branch
from
795dbd9
to
1783173
Compare
…eet PCI4 requirements
davidchin
force-pushed
the
integrity_hash
branch
from
1783173
to
c3ba015
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What?
Include integrity hashes in
manifest.jsonto be added to the scripts and stylesheets used during checkout. Any script or stylesheet that doesn't match its corresponding subresource integrity hash (SRI) will not be executed.Why?
To comply with the script integrity requirement (6.4.3) of PCI4, which ensures that scripts executed during checkout have not been tampered with by a malicious attacker.
Testing / Proof
@bigcommerce/team-checkout