I did see subresource integrity, but I was also curious about last month's string of high profile magecart vulnerabilities, would subresource have saved them there, or is there more to it?
It's been interesting working with teams that have well-defined release management workflows and continuous integration with snapshotted npm/mvn dependencies, but still allow a third party like GA to inject JS that skips the QA queue.
Likewise with CloudFlare: Allowing a third party to proxy all your traffic is a huge liability. CloudBleed should have been a wake-up call, but it doesn't seem to have had much effect.
After seeing the magecart attacks at BA and Newegg I decided to try and build a solution: https://magehash.com, unsure if it's useful yet, what do you think?
I'm thinking about integrating it in existing CI/CD workflows, to avoid false positives too
6 comments
[ 3.1 ms ] story [ 21.6 ms ] threadhttps://hacks.mozilla.org/2015/09/subresource-integrity-in-f...
* Someone injecting malicious JS code into your checkout page
* Non-static JS includes like Google Analytics
But it works well for static assets like jQuery or other static JS resources.
Likewise with CloudFlare: Allowing a third party to proxy all your traffic is a huge liability. CloudBleed should have been a wake-up call, but it doesn't seem to have had much effect.
I'm thinking about integrating it in existing CI/CD workflows, to avoid false positives too