fix(sri): only penalize off-origin proto-relative URLs on HTTP - #561

Draft

caugner wants to merge 25 commits into

558-sri-same-originfrom

464-protocol-relative-urls-with-https

Commits on Apr 10, 2026

test(sri): expect proto-relative URLs to be secure on HTTPS
caugner
committed
ae02424
fix(analyzer/sri): treat proto-relative URLs secure on HTTPS
caugner
committed
de4267b
test(sri): add asserts to existing test
caugner
committed
a74f343

Commits on Jul 15, 2026

Merge branch 'main' into 464-protocol-relative-urls-with-https
caugner
authored
a49a7d1
fix(analyzer/sri): only penalize off-origin proto-relative URLs on HTTP
caugner
committed
84f5396
docs(grader/sri): clarify protocol-relative URL penalty descriptions
caugner
committed
287f5b3
test(sri): cover proto-relative URLs when no HTTP server exists
caugner
committed
85fc292
refactor(analyzer/sri): hoist site domain out of the script loop
caugner
committed
91875ae
fix(analyzer/sri): require every post-initial redirect hop to be HTTPS
caugner
committed
0874823
docs(analyzer/sri): condense protocol-relative URL rationale comment
caugner
committed
4180cb2
test(sri): split on-origin protocol-relative case into its own test
caugner
committed
29ce324
Merge branch '558-sri-same-origin' into 464-protocol-relative-urls-with-https
caugner
committed
dec42d3
refactor(analyzer/sri): derive script scheme by resolving against base URL
caugner
committed
c5d8942
docs(analyzer/sri): fix outdated off-origin guard comment
caugner
committed
fe87d13
refactor(analyzer/sri): rename `secureOrigin` to `sameOrigin`
caugner
committed
e5ae67b
docs(analyzer/sri): clarify same-origin SRI bonus comment
caugner
committed
0adc7d6
test(sri): keep same-origin protocol-relative case in the same-origin test
caugner
committed
a3f2ee4
test(sri): repurpose sameorigin3 fixture as same-origin protocol-relative
caugner
committed
e0a534a
test(sri): drop redundant on-origin enforcement-independence test
caugner
committed
e692596
test(sri): rename test fixtures
caugner
committed
71238f6
fix(analyzer/sri): treat http-to-https redirect via http hop as secure
caugner
committed
ca597ca
docs(analyzer/sri): tighten comments and drop duplication
caugner
committed
8557f70
refactor(analyzer/sri): resolve each script URL once
caugner
committed
66c9df1
fix(analyzer/sri): skip a script `src` that fails to resolve
caugner
committed
77f5be6
docs(analyzer/sri): use American spelling `penalized`
caugner
committed
1b66caa

Navigation Menu

Uh oh!

fix(sri): only penalize off-origin proto-relative URLs on HTTP - #561

fix(sri): only penalize off-origin proto-relative URLs on HTTP#561
caugner wants to merge 25 commits into
558-sri-same-originfrom
464-protocol-relative-urls-with-https

Commits on Apr 10, 2026

test(sri): expect proto-relative URLs to be secure on HTTPS

fix(analyzer/sri): treat proto-relative URLs secure on HTTPS

test(sri): add asserts to existing test

Commits on Jul 15, 2026

Merge branch 'main' into 464-protocol-relative-urls-with-https

fix(analyzer/sri): only penalize off-origin proto-relative URLs on HTTP

docs(grader/sri): clarify protocol-relative URL penalty descriptions

test(sri): cover proto-relative URLs when no HTTP server exists

refactor(analyzer/sri): hoist site domain out of the script loop

fix(analyzer/sri): require every post-initial redirect hop to be HTTPS

docs(analyzer/sri): condense protocol-relative URL rationale comment

test(sri): split on-origin protocol-relative case into its own test

Merge branch '558-sri-same-origin' into 464-protocol-relative-urls-with-https

refactor(analyzer/sri): derive script scheme by resolving against base URL

docs(analyzer/sri): fix outdated off-origin guard comment

refactor(analyzer/sri): rename `secureOrigin` to `sameOrigin`

docs(analyzer/sri): clarify same-origin SRI bonus comment

test(sri): keep same-origin protocol-relative case in the same-origin test

test(sri): repurpose sameorigin3 fixture as same-origin protocol-relative

test(sri): drop redundant on-origin enforcement-independence test

test(sri): rename test fixtures

fix(analyzer/sri): treat http-to-https redirect via http hop as secure

docs(analyzer/sri): tighten comments and drop duplication

refactor(analyzer/sri): resolve each script URL once

fix(analyzer/sri): skip a script `src` that fails to resolve

docs(analyzer/sri): use American spelling `penalized`