Skip to content

fix: not try to add integrity to tags with remote url#12262

Merged
LingyuCoder merged 1 commit intomainfrom
fix/sri-remote-url
Nov 21, 2025
Merged

fix: not try to add integrity to tags with remote url#12262
LingyuCoder merged 1 commit intomainfrom
fix/sri-remote-url

Conversation

@LingyuCoder
Copy link
Contributor

Summary

fix #12251

Related links

Checklist

  • Tests updated (or not required).
  • Documentation updated (or not required).

Copilot AI review requested due to automatic review settings November 21, 2025 08:51
@netlify
Copy link

netlify bot commented Nov 21, 2025

Deploy Preview for rspack canceled.

Name Link
🔨 Latest commit e1222cb
🔍 Latest deploy log https://app.netlify.com/projects/rspack/deploys/6920281799341600086b11ac

@github-actions github-actions bot added release: bug fix release: bug related release(mr only) team The issue/pr is created by the member of Rspack. labels Nov 21, 2025
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes an issue where the Subresource Integrity (SRI) plugin was attempting to add integrity attributes to script and link tags with remote URLs (http/https), which would fail since the build system cannot compute integrity hashes for external resources not part of the build output.

Key Changes

  • Added logic to skip SRI processing for tags with remote URLs (http/https protocol) that don't match the publicPath
  • Implemented the fix consistently in both TypeScript (for HtmlRspackPlugin/HtmlWebpackPlugin integration) and Rust (for native implementation)
  • Added comprehensive test coverage for both plugin types to verify remote URLs are excluded from integrity processing while local bundles still receive integrity attributes

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
packages/rspack/src/builtin-plugin/SubresourceIntegrityPlugin.ts Added URL parsing logic to skip remote URLs in the processTag method
crates/rspack_plugin_sri/src/html.rs Added equivalent Rust implementation to skip remote URLs in process_tag function
crates/rspack_plugin_sri/Cargo.toml Added url crate dependency for URL parsing, minor formatting adjustment to lints section
Cargo.lock Updated to include url dependency for rspack_plugin_sri
tests/rspack-test/configCases/sri/remote-src/rspack.config.js Added test configurations for both HtmlRspackPlugin and HtmlWebpackPlugin to verify remote URLs are excluded
tests/rspack-test/configCases/sri/remote-src/index.js Added minimal test entry point
tests/rspack-test/configCases/sri/remote-src/test.config.js Configured test to skip runtime tests (noTests: true) since verification is done via compilation hooks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@LingyuCoder LingyuCoder enabled auto-merge (squash) November 21, 2025 09:01
@github-actions
Copy link
Contributor

📦 Binary Size-limit

Comparing e1222cb to feat: support SRI with experiments.css and CssExtractRspackPlugin (#12239) by harpsealjs

❌ Size increased by 512bytes from 47.63MB to 47.63MB (⬆️0.00%)

@codspeed-hq
Copy link

codspeed-hq bot commented Nov 21, 2025

CodSpeed Performance Report

Merging #12262 will not alter performance

Comparing fix/sri-remote-url (e1222cb) with main (7763043)

Summary

✅ 17 untouched

@LingyuCoder LingyuCoder merged commit 4746bb1 into main Nov 21, 2025
56 checks passed
@LingyuCoder LingyuCoder deleted the fix/sri-remote-url branch November 21, 2025 09:11
@nanianlisao
Copy link
Contributor

@LingyuCoder
Could you please further improve compatibility with paths starting with //? Sometimes, protocols might be intentionally ignored to prevent browser warnings, for example, when using '//cdn.xx1/unpkg/um.js'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release: bug fix release: bug related release(mr only) team The issue/pr is created by the member of Rspack.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: SubresourceIntegrityPlugin ignoring remote connections instead of throwing an error

4 participants