From 68a1eed11ed14b3983080e3b65dc6991a62b5c38 Mon Sep 17 00:00:00 2001
From: Lorenzo Natali <lorenzo.natali@geosolutionsgroup.com>
Date: Tue, 2 Apr 2024 19:25:32 +0200
Subject: [PATCH] [Backport 2024.01.xx] Integrity check attribute for external
 JS resources (#10140)

* #9997 Add integrity check for external script (#10035)

* Fix async load for script in templates (#10073)
---
 project/standard/templates/dashboard-embedded-template.html | 4 +++-
 project/standard/templates/embeddedTemplate.html            | 4 +++-
 project/standard/templates/geostory-embedded-template.html  | 4 +++-
 project/standard/templates/indexTemplate.html               | 6 ++++--
 web/client/dashboard-embedded-template.html                 | 4 +++-
 web/client/embeddedTemplate.html                            | 4 +++-
 web/client/geostory-embedded-template.html                  | 4 +++-
 web/client/indexTemplate.html                               | 4 +++-
 8 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/project/standard/templates/dashboard-embedded-template.html b/project/standard/templates/dashboard-embedded-template.html
index aa4847a90d..c63cd0345b 100644
--- a/project/standard/templates/dashboard-embedded-template.html
+++ b/project/standard/templates/dashboard-embedded-template.html
@@ -96,7 +96,9 @@
         <link rel="preconnect" href="https://fonts.gstatic.com">
         <link href="https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap" rel="stylesheet">
         <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
-        <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+        <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+            async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+            onload="checkBrowser()"></script>
         <script type="text/javascript">
             function checkBrowser() {
                 var browserInfo = bowser.getParser(window.navigator.userAgent);
diff --git a/project/standard/templates/embeddedTemplate.html b/project/standard/templates/embeddedTemplate.html
index d957ca5f12..2e94c27992 100644
--- a/project/standard/templates/embeddedTemplate.html
+++ b/project/standard/templates/embeddedTemplate.html
@@ -87,7 +87,9 @@
         <link rel="shortcut icon" type="image/png" href="https://cdn.jslibs.mapstore2.geo-solutions.it/leaflet/favicon.ico" />
         <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
         <!--script src="https://cdnjs.cloudflare.com/ajax/libs/proj4js/2.3.10/proj4.js"></script-->
-        <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+        <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+            async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+            onload="checkBrowser()"></script>
         <script type="text/javascript">
             function checkBrowser() {
                 var browserInfo = bowser.getParser(window.navigator.userAgent);
diff --git a/project/standard/templates/geostory-embedded-template.html b/project/standard/templates/geostory-embedded-template.html
index 390bdd0a28..b34988d934 100644
--- a/project/standard/templates/geostory-embedded-template.html
+++ b/project/standard/templates/geostory-embedded-template.html
@@ -96,7 +96,9 @@
     <link href="https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap" rel="stylesheet">
     <link rel="shortcut icon" type="image/png" href="https://cdn.jslibs.mapstore2.geo-solutions.it/leaflet/favicon.ico" />
     <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
-    <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+    <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+        async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+        onload="checkBrowser()"></script>
     <script type="text/javascript">
         function checkBrowser() {
             var browserInfo = bowser.getParser(window.navigator.userAgent);
diff --git a/project/standard/templates/indexTemplate.html b/project/standard/templates/indexTemplate.html
index 790ed2e814..b7afb1d5fa 100644
--- a/project/standard/templates/indexTemplate.html
+++ b/project/standard/templates/indexTemplate.html
@@ -86,8 +86,10 @@
       <link href="https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap" rel="stylesheet">
       <link rel="shortcut icon" type="image/png" href="https://cdn.jslibs.mapstore2.geo-solutions.it/leaflet/favicon.ico" />
       <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
-      <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
-      <script type="text/javascript">
+    <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+        async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+        onload="checkBrowser()"></script>
+    <script type="text/javascript">
         function checkBrowser() {
             var browserInfo = bowser.getParser(window.navigator.userAgent);
             var isValidBrowser = browserInfo.satisfies({
diff --git a/web/client/dashboard-embedded-template.html b/web/client/dashboard-embedded-template.html
index b663515ffa..98dcc4cc44 100644
--- a/web/client/dashboard-embedded-template.html
+++ b/web/client/dashboard-embedded-template.html
@@ -96,7 +96,9 @@
         <link rel="preconnect" href="https://fonts.gstatic.com">
         <link href="https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap" rel="stylesheet">
         <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
-        <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+        <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+            async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+            onload="checkBrowser()"></script>
         <script type="text/javascript">
             function checkBrowser() {
                 var browserInfo = bowser.getParser(window.navigator.userAgent);
diff --git a/web/client/embeddedTemplate.html b/web/client/embeddedTemplate.html
index b31eb778d9..b674fb1627 100644
--- a/web/client/embeddedTemplate.html
+++ b/web/client/embeddedTemplate.html
@@ -87,7 +87,9 @@
         <link rel="shortcut icon" type="image/png" href="https://cdn.jslibs.mapstore2.geo-solutions.it/leaflet/favicon.ico" />
         <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
         <!--script src="https://cdnjs.cloudflare.com/ajax/libs/proj4js/2.3.10/proj4.js"></script-->
-        <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+        <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+            async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+            onload="checkBrowser()"></script>
         <script type="text/javascript">
             function checkBrowser() {
                 var browserInfo = bowser.getParser(window.navigator.userAgent);
diff --git a/web/client/geostory-embedded-template.html b/web/client/geostory-embedded-template.html
index 481840792f..f931be966a 100644
--- a/web/client/geostory-embedded-template.html
+++ b/web/client/geostory-embedded-template.html
@@ -96,7 +96,9 @@
     <link href="https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap" rel="stylesheet">
     <link rel="shortcut icon" type="image/png" href="https://cdn.jslibs.mapstore2.geo-solutions.it/leaflet/favicon.ico" />
     <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
-    <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+    <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+        async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+        onload="checkBrowser()"></script>
     <script type="text/javascript">
         function checkBrowser() {
             var browserInfo = bowser.getParser(window.navigator.userAgent);
diff --git a/web/client/indexTemplate.html b/web/client/indexTemplate.html
index 56155c619e..7215e2cfab 100644
--- a/web/client/indexTemplate.html
+++ b/web/client/indexTemplate.html
@@ -86,7 +86,9 @@
     <link href="https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap" rel="stylesheet">
     <link rel="shortcut icon" type="image/png" href="https://cdn.jslibs.mapstore2.geo-solutions.it/leaflet/favicon.ico" />
     <!--script src="https://maps.google.com/maps/api/js?v=3"></script-->
-    <script async type="text/javascript" src="https://unpkg.com/bowser@2.7.0/es5.js" onload="checkBrowser()"></script>
+    <script src="https://unpkg.com/bowser@2.7.0/es5.js"
+        async integrity="sha384-CWiXbo5RNu6nv9tiCWA2y1DQKjEQDDH+yFQga1FytuIZjOTcVr+4ojw2S2lShj/d" crossorigin="anonymous"
+        onload="checkBrowser()"></script>
     <script type="text/javascript">
       function checkBrowser() {
           var browserInfo = bowser.getParser(window.navigator.userAgent);