Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.From Security Metrics on a recent scan:
What is the issue?
The application includes 3rd party JavaScript libraries and does not perform a Subresource Integrity check.
What is the impact of this issue?
The single greatest risk is a compromise of the third party JavaScript server and the injection of malicious JavaScript into the host. This has happened as recently as June 2019.
The invocation of 3rd party JavaScript code in a web application requires consideration for three risks in particular:
• The loss of control over changes to the client application
• The execution of arbitrary code on client systems
• The disclosure or leakage of sensitive information to 3rd parties
How can this issue be fixed? Review 3rd party scripts.
• Verify the integrity of the script with a Subresource Integrity check.
• If the 3rd party system does not support CORS, host the file locally.
References
• https://www.owasp.org/index.php/3rd_Party_Javascript_Management_Cheat_Sheet
• https://blog.malwarebytes.com/threat-analysis/2019/06/magecart-skimmers-...
cloudfront-cdn/
• https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/
• https://www.zdnet.com/article/inbenta-blamed-for-ticketmaster-breach-say...
• https://www.srihash.org/
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | commerce_braintree-subsource_integrity_check-3090170-2.patch | 1.86 KB | andyg5000 |
Comments
Comment #2
andyg5000Here's a patch to add the hashes for all versioned resources. I didn't want to add the ones for https://www.paypalobjects.com/api/checkout.js because I don't trust PayPal will server the same file and it could break sites referencing the wrong hash. Not sure how to handle that one :(
Comment #3
andyg5000Comment #4
lisastreeter commentedPatch looks good and applied cleanly. I tested all three payment method types as well as a stored payment method on my local dev site. All worked properly.
Comment #6
lisastreeter commentedCommitted, thanks!