Open ToshY opened 9 months ago
Hey @weaverryan π
Could you possibly spare some time to take a look at this? I've just found the related PR #161 which has been open for well over a year, signifying the same issue with a proposed fix, but is has never been merged.
@weaverryan @jrushlow please take a look at this.
@weaverryan @jrushlow please take a look at this.
@weaverryan @jrushlow please take a look at this.
Thank you for doing all this research, I just ran into this issue as well @ToshY.
@ping-localhost No problem. I'm just slightly disappointed that PR #161 was created over 2 years ago and is still just sitting there collection dust. π€·ββοΈ
Problem
I've been scratching my head for a while on why I'm getting warnings in my Chrome console denoting the following:
This happens when I enable integrity hashes in my
webpack.config.js
and havepreload: true
in thewebpack_encore.yaml
.Looking at the
Link
response header I see the following:Initially I didn't think much of it (as I don't experience with this at all), but after a bit of researching I landed at the Asset Preloading and Resource Hints with HTTP/2 and WebLink documentation. Here I've found the following section:
After following the link I saw this:
So basically "integrity metadata" is part of the (so-called) "preload entry".
Reproduction
```yml webpack_encore: # The path where Encore is building the assets - i.e. Encore.setOutputPath() output_path: '%kernel.project_dir%/public/build' # If multiple builds are defined (as shown below), you can disable the default build: # output_path: false # Set attributes that will be rendered on all script and link tags script_attributes: defer: true # link_attributes: # If using Encore.enableIntegrityHashes() and need the crossorigin attribute (default: false, or use 'anonymous' or 'use-credentials') # crossorigin: 'anonymous' # Preload all rendered script and link tags automatically via the HTTP/2 Link header preload: true ```./config/webpack-encore.yaml
Very basic (truncated) config example, as it only concerns the option `.enableIntegrityHashes()` ```js const Encore = require('@symfony/webpack-encore'); if (!Encore.isRuntimeEnvironmentConfigured()) { Encore.configureRuntimeEnvironment(process.env.NODE_ENV || 'dev'); } Encore .setOutputPath('public/build/') .setPublicPath('/build') .addEntry('js/app', './assets/js/main.js') .addStyleEntry('css/app', './assets/styles/global.scss') .addStyleEntry('css/cs', './assets/styles/custom.css') .splitEntryChunks() .enableIntegrityHashes(Encore.isProduction()) ; module.exports = Encore.getWebpackConfig(); ```./webpack.config.js
Cause
After finding out that the missing integrity in the
Link
response header might be the cause of the issue, I set out in trying to debug it π΅οΈI've found that the files involved are
PreLoadAssetsEventListener
andTagRenderer
.PreLoadAssetsEventListener
In
PreLoadAssetsEventListener.php#L50-L68
this part is apparently creating the preload links.There is currently nothing here that adds the
integrity
to the link, regardless where is should get this info from (we shall see later it can be retrieved from theTagRenderer
).TagRenderer
The
TagRenderer
has 2 methods thare are directly called from inside thePreLoadAssetsEventListener
, which aregetRenderedScripts()
andgetRenderedStyles()
.Looking at both methods they will return either the script or styles that are available from
$this->renderedFiles
. However, both thescripts
andstyles
keys contain simple string arrays of hrefs, as they were added to these arrays in TagRenderer.php#L80 and TagRenderer.php#L118 respectively.The
integrity
for both is available as can be seen in TagRenderer.php#L62 and TagRenderer.php#L100, but can/is not being used anywhere else.Possible solution
After finding out all of the above, I've started trying to think of way on how to "fix" this without making breaking changes π
TagRenderer::getAttributes()
In order to be able to get and use the integrity inside the
PreLoadAssetsEventListener
, we need to find a way to have theTagRenderer
return the complete attributes result (which contains the integrity hash).To do this I've thought of adding a private property
$attributes
with a public methodgetAttributes()
(similar to the existinggetRenderedScripts()
andgetRenderedStyles()
methods). At the end of the loop it will append to the array of$this->attributes
in a similar it way as it does for$this->renderedFiles
, however now for all attributes and not just thesrc
orhref
.
```php * For the full copyright and license information, please view the LICENSE * file that was distributed with this source code. */ namespace Symfony\WebpackEncoreBundle\Asset; use Symfony\Component\Asset\Packages; use Symfony\Contracts\EventDispatcher\EventDispatcherInterface; use Symfony\Contracts\Service\ResetInterface; use Symfony\WebpackEncoreBundle\Event\RenderAssetTagEvent; /** * @final */ class TagRenderer implements ResetInterface { private $entrypointLookupCollection; private $packages; private $defaultAttributes; private $defaultScriptAttributes; private $defaultLinkAttributes; private $eventDispatcher; private $renderedFiles = []; private $attributes = []; public function __construct( EntrypointLookupCollectionInterface $entrypointLookupCollection, Packages $packages, array $defaultAttributes = [], array $defaultScriptAttributes = [], array $defaultLinkAttributes = [], EventDispatcherInterface $eventDispatcher = null ) { $this->entrypointLookupCollection = $entrypointLookupCollection; $this->packages = $packages; $this->defaultAttributes = $defaultAttributes; $this->defaultScriptAttributes = $defaultScriptAttributes; $this->defaultLinkAttributes = $defaultLinkAttributes; $this->eventDispatcher = $eventDispatcher; $this->reset(); } public function renderWebpackScriptTags(string $entryName, string $packageName = null, string $entrypointName = null, array $extraAttributes = []): string { $entrypointName = $entrypointName ?: '_default'; $scriptTags = []; $entryPointLookup = $this->getEntrypointLookup($entrypointName); $integrityHashes = ($entryPointLookup instanceof IntegrityDataProviderInterface) ? $entryPointLookup->getIntegrityData() : []; foreach ($entryPointLookup->getJavaScriptFiles($entryName) as $filename) { $attributes = []; $attributes['src'] = $this->getAssetPath($filename, $packageName); $attributes = array_merge($attributes, $this->defaultAttributes, $this->defaultScriptAttributes, $extraAttributes); if (isset($integrityHashes[$filename])) { $attributes['integrity'] = $integrityHashes[$filename]; } $event = new RenderAssetTagEvent( RenderAssetTagEvent::TYPE_SCRIPT, $attributes['src'], $attributes ); if (null !== $this->eventDispatcher) { $event = $this->eventDispatcher->dispatch($event); } $attributes = $event->getAttributes(); $scriptTags[] = sprintf( '', $this->convertArrayToAttributes($attributes) ); $this->renderedFiles['scripts'][] = $attributes['src']; $this->attributes['scripts'][$attributes['src']] = $attributes; } return implode('', $scriptTags); } public function renderWebpackLinkTags(string $entryName, string $packageName = null, string $entrypointName = null, array $extraAttributes = []): string { $entrypointName = $entrypointName ?: '_default'; $scriptTags = []; $entryPointLookup = $this->getEntrypointLookup($entrypointName); $integrityHashes = ($entryPointLookup instanceof IntegrityDataProviderInterface) ? $entryPointLookup->getIntegrityData() : []; foreach ($entryPointLookup->getCssFiles($entryName) as $filename) { $attributes = []; $attributes['rel'] = 'stylesheet'; $attributes['href'] = $this->getAssetPath($filename, $packageName); $attributes = array_merge($attributes, $this->defaultAttributes, $this->defaultLinkAttributes, $extraAttributes); if (isset($integrityHashes[$filename])) { $attributes['integrity'] = $integrityHashes[$filename]; } $event = new RenderAssetTagEvent( RenderAssetTagEvent::TYPE_LINK, $attributes['href'], $attributes ); if (null !== $this->eventDispatcher) { $this->eventDispatcher->dispatch($event); } $attributes = $event->getAttributes(); $scriptTags[] = sprintf( '', $this->convertArrayToAttributes($attributes) ); $this->renderedFiles['styles'][] = $attributes['href']; $this->attributes['styles'][$attributes['href']] = $attributes; } return implode('', $scriptTags); } public function getRenderedScripts(): array { return $this->renderedFiles['scripts']; } public function getRenderedStyles(): array { return $this->renderedFiles['styles']; } public function getDefaultAttributes(): array { return $this->defaultAttributes; } public function getAttributes(): array { return $this->attributes; } /** * @return void */ public function reset() { $this->renderedFiles = [ 'scripts' => [], 'styles' => [], ]; } private function getAssetPath(string $assetPath, string $packageName = null): string { if (null === $this->packages) { throw new \Exception('To render the script or link tags, run "composer require symfony/asset".'); } return $this->packages->getUrl( $assetPath, $packageName ); } private function getEntrypointLookup(string $buildName): EntrypointLookupInterface { return $this->entrypointLookupCollection->getEntrypointLookup($buildName); } private function convertArrayToAttributes(array $attributesMap): string { // remove attributes set specifically to false $attributesMap = array_filter($attributesMap, static function ($value) { return false !== $value; }); return implode(' ', array_map( static function ($key, $value) { // allows for things like defer: true to only render "defer" if (true === $value || null === $value) { return $key; } return sprintf('%s="%s"', $key, htmlentities($value)); }, array_keys($attributesMap), $attributesMap )); } } ```TagRenderer
PreLoadAssetsEventListener
After adding
TagRenderer::getAttributes()
it can now be used in thePreLoadAssetsEventListener
.It boils down to adding the following snippet in both foreach statements:
```php * For the full copyright and license information, please view the LICENSE * file that was distributed with this source code. */ namespace Symfony\WebpackEncoreBundle\EventListener; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\ResponseEvent; use Symfony\Component\WebLink\GenericLinkProvider; use Symfony\Component\WebLink\Link; use Symfony\WebpackEncoreBundle\Asset\EntrypointLookupCollectionInterface; use Symfony\WebpackEncoreBundle\Asset\TagRenderer; /** * @author Ryan WeaverPreLoadAssetsEventListener
Result
After applying the above solution I see the following
Link
header in my response.There are no longer warnings in the Chrome console regarding preload integrity mismatch.
TLDR
As I really would like this to be fixed, I can create a (draft) PR for this if that's okay. I'm not sure if the above solution is a proper way to do this in a technical sense, but that's what I came up with for now. π