kindspells / astro-shield

Astro integration to enhance your website's security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques.
https://astro-shield.kindspells.dev
MIT License
58 stars 6 forks source link

generateSRIHashesModule function generates invalid strings on windows #84

Open felixcicatt opened 4 months ago

felixcicatt commented 4 months ago

Because file paths on windows use the backslash character as a path separator, and the generateSRIHashesModule function concatenates the path of pages directly as a string in the perPageSriHashes part of the file it generates, the end result contains invalid strings, because the backslashes need to be escaped:

image

This could be fixed by escaping the paths before concatenating them into the end result, with a function like below. I can submit a PR if you like.

/**
 * @param {string} s 
 * @returns {string}
 */
const escapeJsonString = (s) => {
    if(!s) return s
    const json = JSON.stringify(s)
    return json.substring(1, json.length - 1)
}
castarco commented 2 months ago

Hi @felixcicatt , please excuse me for taking so much time before answering.

Is this a big problem? Or could be dealt with by relying on WSL? I'm not quite sure about providing this kind of support for Windows, given that almost no single real website runs on it, except for local development environments (and these can be "patched up" via WSL).