ihashgen release: A node library that generate hash for SRI

I created a new project on NPM which is named as ihashgen.

The cli tools basically will create a hash version based on the url of the CDN for either CSS or JS file.

Used of CDN in projects will significantly increase the loading speed, but in case the CDN is compromised (unpkg cdn was compromised.), your user is still safe from those attack.

This library basically automated the task on generating the hash for you with SHA384 algorithm.

Repository

https://github.com/superoo7/ihashgen

Features

What feature(s) did you add?

• A CLI tools to generate hash and html version of script tag or link tag.

> yarn global add ihashgen # npm install -g ihashgen
> ihashgen

• A node library to use the functions to generate the hash. (works with babel import and typescript)

import ihashgen from 'ihashgen';
ihashgen('https://unpkg.com/react@16/umd/react.production.min.js')
  .then(data => {
    console.log(data.hash);
    console.log(data.html);
  })

• Automatically detect the file type (css/js) by checking the ending url.

How did you implement it/them?

This project has 1 core functions which is intergrityGen;

import axios from "axios";
import SHA384 from "crypto-js/sha384";
import Base64 from "crypto-js/enc-base64";

export type cdnType = "css" | "js";
export type algoType = "sha384";

const intergrityGen = async (url: string, type?: cdnType, algo?: algoType) => {
  // TODO: support more hashing algorithm

  if (!algo) {
    algo = "sha384";
  }

  if (!type) {
    type = url.endsWith("css") ? "css" : url.endsWith("js") ? "js" : undefined;
  }
  if (type === undefined) throw new Error("must specify type for cdn (css/js)");

  const hash = await axios.get(url).then(d => Base64.stringify(SHA384(d.data)));
  return {
    hash: hash,
    html: template(type, url, hash, algo)
  };
};

export const template = (
  type: cdnType,
  url: string,
  hash: string,
  algo: algoType
) => {
  if (type !== "css" && type !== "js")
    throw new Error("must specify type for cdn (css/js)");

  return type === "css"
    ? `<link rel="stylesheet" href="${url}" integrity="${algo}-${hash}" crossorigin="anonymous">`
    : `<script src="${url}" integrity="${algo}-${hash}" crossorigin="anonymous"></script>`;
};

export default intergrityGen;

About ihashgen

What is the project about?

Generate Intergrity hash for the use of CDN, which can be used via CLI or Node packages.

• Technology Stack

  • Typescript
  • Node.js
    CLI
  • commander
  • chalk
  • ora
  • inquirer
    Test
  • Jest
    Library used
  • Crypto-Js
  • Axios

Roadmap

• Support other hashing algorithm like SHA256.

• Create webpack configuration for dynamic-cdn-webpack-plugin or a fork version to further automate task.

• How to contribute?

Project is hosted on Github: https://github.com/superoo7/ihashgen with Travis CI to check wether the test passes. Feel free to fork and file issues.

GitHub Account

https://github.com/superoo7