fix: should match protocol-relative url of public path and tag src in SRI plugin #12265
Conversation
✅ Deploy Preview for rspack canceled.
|
github-actions
bot
added
release: bug fix
LingyuCoder
changed the title
There was a problem hiding this comment.
Pull Request Overview
This PR fixes the Subresource Integrity (SRI) plugin to properly handle protocol-relative URLs (URLs starting with //) and ensure they're correctly matched against the configured publicPath regardless of whether one uses an explicit protocol (http: or https:) and the other doesn't.
Key Changes:
- Normalizes both tag source URLs and
publicPathto protocol-relative format for comparison - Applies SRI integrity attributes to resources that match the
publicPathregardless of protocol differences - Adds comprehensive test coverage for various protocol matching scenarios
Reviewed Changes
Copilot reviewed 6 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
packages/rspack/src/builtin-plugin/SubresourceIntegrityPlugin.ts |
Updated TypeScript implementation to normalize URLs by removing protocols before comparison and then restoring the publicPath protocol |
crates/rspack_plugin_sri/src/html.rs |
Updated Rust implementation with equivalent protocol normalization logic |
crates/rspack_plugin_sri/Cargo.toml |
Added once_cell dependency for lazy static regex initialization |
Cargo.lock |
Updated lock file with once_cell dependency |
tests/rspack-test/configCases/sri/remote-src-protocol/rspack.config.js |
Added comprehensive test cases covering all combinations of protocol-relative and explicit protocol URLs |
tests/rspack-test/configCases/sri/remote-src-protocol/test.config.js |
Added test configuration |
tests/rspack-test/configCases/sri/remote-src-protocol/index.js |
Added test entry point with dynamic import |
tests/rspack-test/configCases/sri/remote-src-protocol/chunk.js |
Added empty chunk file for dynamic import testing |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Check this test case. Does this meet your requirements? @nanianlisao
📦 Binary Size-limit
❌ Size increased by 6.88KB from 47.63MB to 47.64MB (⬆️0.01%) |
CodSpeed Performance ReportMerging #12265 will degrade performances by 20.41%Comparing Summary
Benchmarks breakdown
|
Summary
Support protocol-relative url when match public path and tag src. Both the public path and tag src can be protocol-relative url. If they are matched, the SRI integrity hash should be found and add to the tag.
Originally posted by @nanianlisao in #12262 (comment)
Related links
Checklist