Subresource Integrity issue while calling youtube frame api

videojs / videojs-youtube

YouTube playback technology for Video.js

1.12k stars 548 forks source link

Subresource Integrity issue while calling youtube frame api #566

Open RoopanV opened 4 years ago

RoopanV commented 4 years ago

Hi, Our audit team find SRI not implement while loading script from "https://www.youtube.com/iframe_api" using "loadScript" method during a vulnerability scan. Can you please check the possibility of adding the integrity hash.

gkatsev commented 4 years ago

I'm not sure it's possible to do since the iframe_api isn't something that we own and youtube may change it whenever they want.