From 2a0014e361b6e120edc87cfa69cf68ae1723a8dd Mon Sep 17 00:00:00 2001 From: Yuri S Date: Sat, 9 Jun 2018 17:52:16 +0500 Subject: [PATCH 1/4] Fix integrity hash --- lib/sprockets/asset.rb | 2 +- lib/sprockets/manifest.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/sprockets/asset.rb b/lib/sprockets/asset.rb index ae8f29318..9c96fc9e0 100644 --- a/lib/sprockets/asset.rb +++ b/lib/sprockets/asset.rb @@ -138,7 +138,7 @@ def base64digest # Public: A "named information" URL for subresource integrity. def integrity - DigestUtils.integrity_uri(metadata[:digest]) + DigestUtils.integrity_uri(Digest::SHA256.digest(source)) end # Public: Add enumerator to allow `Asset` instances to be used as Rack diff --git a/lib/sprockets/manifest.rb b/lib/sprockets/manifest.rb index 2c37e6864..6cf6c0388 100644 --- a/lib/sprockets/manifest.rb +++ b/lib/sprockets/manifest.rb @@ -181,7 +181,7 @@ def compile(*args) # Deprecated: Remove beta integrity attribute in next release. # Callers should DigestUtils.hexdigest_integrity_uri to compute the # digest themselves. - 'integrity' => DigestUtils.hexdigest_integrity_uri(asset.hexdigest) + 'integrity' => asset.integrity } assets[asset.logical_path] = asset.digest_path From 3c88d585aa68f6dc56b96770652aa7fd78e32305 Mon Sep 17 00:00:00 2001 From: Yuri S Date: Mon, 23 Jul 2018 09:12:46 +0500 Subject: [PATCH 2/4] Revert "Fix integrity hash" This reverts commit 2a0014e361b6e120edc87cfa69cf68ae1723a8dd. --- lib/sprockets/asset.rb | 2 +- lib/sprockets/manifest.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/sprockets/asset.rb b/lib/sprockets/asset.rb index 9c96fc9e0..ae8f29318 100644 --- a/lib/sprockets/asset.rb +++ b/lib/sprockets/asset.rb @@ -138,7 +138,7 @@ def base64digest # Public: A "named information" URL for subresource integrity. def integrity - DigestUtils.integrity_uri(Digest::SHA256.digest(source)) + DigestUtils.integrity_uri(metadata[:digest]) end # Public: Add enumerator to allow `Asset` instances to be used as Rack diff --git a/lib/sprockets/manifest.rb b/lib/sprockets/manifest.rb index 6cf6c0388..2c37e6864 100644 --- a/lib/sprockets/manifest.rb +++ b/lib/sprockets/manifest.rb @@ -181,7 +181,7 @@ def compile(*args) # Deprecated: Remove beta integrity attribute in next release. # Callers should DigestUtils.hexdigest_integrity_uri to compute the # digest themselves. - 'integrity' => asset.integrity + 'integrity' => DigestUtils.hexdigest_integrity_uri(asset.hexdigest) } assets[asset.logical_path] = asset.digest_path From 60fea19987d78c36024b342739948a9a88bcf4fc Mon Sep 17 00:00:00 2001 From: Yuri S Date: Mon, 23 Jul 2018 09:18:29 +0500 Subject: [PATCH 3/4] Revert "Make environment version affect asset digest" This reverts commit 64fadf90882761ed5baac3546c4435c600c50ae5. --- lib/sprockets/loader.rb | 2 +- test/test_environment.rb | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/sprockets/loader.rb b/lib/sprockets/loader.rb index 3680bbaa7..7caa7c44c 100644 --- a/lib/sprockets/loader.rb +++ b/lib/sprockets/loader.rb @@ -158,7 +158,7 @@ def load_from_unloaded(unloaded) source = result.delete(:data) metadata = result metadata[:charset] = source.encoding.name.downcase unless metadata.key?(:charset) - metadata[:digest] = digest(self.version + source) + metadata[:digest] = digest(source) metadata[:length] = source.bytesize else dependencies << build_file_digest_uri(unloaded.filename) diff --git a/test/test_environment.rb b/test/test_environment.rb index d5dc4b803..bcdc81a9a 100644 --- a/test/test_environment.rb +++ b/test/test_environment.rb @@ -716,10 +716,10 @@ def setup assert_equal 2, asset.metadata[:selector_count] end - test "changing version changes the digest of the asset" do + test "changing version doesn't affect the assets digest" do old_asset_digest = @env["gallery.js"].hexdigest @env.version = 'v2' - assert old_asset_digest != @env["gallery.js"].hexdigest + assert old_asset_digest == @env["gallery.js"].hexdigest end test "bundled asset is stale if its mtime is updated or deleted" do From 8f84048368a7de2e12a4b850a0d4201cb61c0bd7 Mon Sep 17 00:00:00 2001 From: Roman Suleymanov Date: Fri, 10 Aug 2018 20:08:54 +0500 Subject: [PATCH 4/4] compare calculated digest with digest from asset --- test/test_environment.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/test_environment.rb b/test/test_environment.rb index bcdc81a9a..30644521e 100644 --- a/test/test_environment.rb +++ b/test/test_environment.rb @@ -720,6 +720,8 @@ def setup old_asset_digest = @env["gallery.js"].hexdigest @env.version = 'v2' assert old_asset_digest == @env["gallery.js"].hexdigest + + assert @env["gallery.js"].hexdigest == Digest::SHA256.new.update(File.binread(fixture_path('default/gallery.js'))).to_s end test "bundled asset is stale if its mtime is updated or deleted" do