SHA-384 integrity checks failed on various css and js files

[Styco]

I set up the latest version of btc-rpc-explorer today, and experienced some issues with the web interface. After pulling up the Chrome console, it appears that various files failed the SHA-384 integrity check. The following files failed to load:

/css/bootstrapmin.css
/js/jquery.min.js
/js/popper.min.js
/js/bootstrap.min.js
/js/highlight.min.js

I temp-fixed it locally by replacing the hashes with an empty string in /views/layout.pug, but it seems like the hashes need to be recomputed and replaced?

[janoside]

Weird. I'm not seeing any errors and resources are loading fine for me. When the files fail to load, the site is fairly broken (poorly styled, JS not working), correct?

For reference, I used the following to compute the current hashes:

openssl dgst -sha384 -binary ./bootstrap.min.js | openssl base64 -A

Any thoughts on this?

[Styco]

Yes, style for the light theme was messed up and dropdown menus did not expand.

[janoside]

Thanks for the details. I'd really like to get this fixed but can't reproduce at the moment...right now I'm using Chrome 71 (and Firefox 65) on macOS without problems. What OS/Chrome are you using? Could you include relevant output from the Chrome console?

[Styco]

This is on Windows 10, both using Chrome 72.0.3626.109 and Firefox 65.0.1. Was able to reproduce on two machines. The Chrome console gives the following output:

(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'http://192.168.1.10:3002/css/bootstrap.min.css' with computed SHA-256 integrity 'O+tIQpqELVwzC5tMwKUYZS4eyhYSH0C9wdTEHk/xoIw='. The resource has been blocked.
(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'http://192.168.1.10:3002/js/jquery.min.js' with computed SHA-256 integrity 'T+aPohYXbm0fRYDpJLr+zJ9RmYTswGsahAoIsNiMld4='. The resource has been blocked.
(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'http://192.168.1.10:3002/js/popper.min.js' with computed SHA-256 integrity 'spe0Ma5RyqeYbXQO2Y0mUpQd3ywjimIy+uOe1InOy7w='. The resource has been blocked.
(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'http://192.168.1.10:3002/js/bootstrap.min.js' with computed SHA-256 integrity 'Tz+u7EaSlLYQ9sqCqhzCszaP1WYRsxxVHC7iJP6ttBE='. The resource has been blocked.
(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'http://192.168.1.10:3002/js/highlight.min.js' with computed SHA-256 integrity 'xy2k6AZyTT2/fvcjjGUXWbBBii/UOxl6QgKcKPeAEsc='. The resource has been blocked.
(index):1 Uncaught ReferenceError: $ is not defined
at (index):1

[Zwilla]

it is up to the devs, to build an automatic function into the build script, will figure out this and will make a pull request

[janoside]

@Styco Thanks for that log output. It's suspicious that the error messages mention SHA-256 integrity, considering that most of the hashes are specified as SHA-384.

[janoside]

@Styco I don't feel confident in this solution, but if you can please let me know if d3ef035 fixes the problem for you. The idea here is that the CSS/JS files may in some way be modified (such as by being automatically minified) when transferred over HTTP as is the case in your setup (when accessed via HTTPS this behavior is not possible), therefore leading to different hashes.

[Styco]

No, that did not fix it. Same issue occurs.

[janoside]

Thanks for the update. I just got set up with a Windows 10 VM and I'm able to reproduce the issue. At the moment I believe the root cause may be line-ending differences between Windows/Unix. Using jquery.min.js as an example, I see that the file size is 86,927 in my local source repository on macOS and is 86,929 on Windows (after using npm install -g janoside/btc-rpc-explorer to install). Still need to compute hashes on Windows and compare to the log output in Chrome. Hopefully they match to confirm this as the root cause and then will move toward fixing it...

[Styco]

Cool, let me know if you need additional testing/feedback!

[janoside]

@Styco If you check out the latest code, including commit 3eb8571, please let me know if the problem is solved for you. In a quick test in my VM the issue was resolved.

[Styco]

Yes, I tested it and can confirm that this fix works!

[janoside]

Great! Thanks for testing for me.