检查请求是否是 Chrome 扩展程序中的子资源完整性

Question

Is it possible to check if a script/stylesheet is integrity protected via subresource-integrity (SRI) from a Chrome extension?

I want to know this before the request is initiated, so this should be done with chrome.webRequest.onBeforeRequest . But it gives no hints about the request as SRI is browser side. Everything happens after the request has finished.

From my point of view the only way to get this information is to access the DOM directly. This would mean I have to stall all requests until the HTML is completely parsed, which doesn't seem the way to go.

Maybe SRI is just too new to be accessible to extensions, as I didn't find it anywhere in the Chrome extension docs.

Answer 1

Yes, you can determine if a resource is protected by subresource-integrity , prior to the request for the resource being made, by checking for the appropriate attribute(s) (ie integrity ) on the element specifying the resource as the element is added to the DOM. You can have a content script that is executed at document_start (either specified in manifest.json ( run_at ), or injected using tabs.executeScript() ¹ ( runAt )). That script could then set up a MutationObserver to watch elements being placed in the DOM. Each appropriate element type (ie <script> and <link> ) would then need to be checked for using subresource-integrity. This check/determination will occur prior to the webRequest.onBeforeRequest event.

Doing this does not stall all requests until the HTML is fully parsed. It performs the check as each element specifying a resource is entered into the DOM. On the other hand, obviously, any additional processing you introduce through the use of the MutationObserver does add some additional time to parsing the HTML, creating the DOM and loading all resources.

---

1. Getting the timing correct to have a script executed at document_start using tabs.executeScript() is non-trivial. How to do so would be a separate question.