Implement SRI check on the external babel links

[freaky4wrld]

Overview

Implement SRI checks for the babel.js script tag in 'default-markdown.html' and 'default.html' to address CodeQL alert 36 and 37, enhancing script integrity and mitigating potential vulnerabilities.

Action Items

• Implement SRI check by adding integrity and crossorigin attribute to the <script> links in the files _layouts/default-markdown.html and _layouts/default.html
• Do remember to make the attribute crossorigin="anonymous" specifically as we don't want to share our credentials with the server
• For integrity attribute use the SRI Generator paste the url https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/6.26.0/babel.js and generate an SHA-384 hash, we are using a specified version of babel (6.26.0)
• Paste the generated hash in the integrity attribute of the both the files, the browser will automatically check for the integrity of the external link, this feature of browser is only in the modern ones, older browsers have no support for SRI.
• Test the changes are by
  • Firstly starting the build with docker-compose up and checking if any errors are generated during the build process
  • Next you can go to the browser-console by pressing CTRL/CMD + SHIFT + I and check for any JavaScript related errors
  • Lastly you can go to the Network Console and reload the web page, then inspect the network requests to confirm that the babel.js script is loaded successfully.
  • Test a JavaScript intensive page such as /projects or /wins inat least two browsers

Resources/Instructions

• Hash generator: https://www.srihash.org
• CodeQL queries: https://github.com/hackforla/website/security/code-scanning/36 and https://github.com/hackforla/website/security/code-scanning/37
• SRI article: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/

[github-actions]

Hi @nelsonuprety1, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

[nelsonuprety1]

Availability: Wed 24 January, 2024
ETA: Wed 24 January, 2024

[nelsonuprety1]

Please check the PR #6152 for this fix.