CVE-2020-15262 (published 2020-10-19T20:15Z)

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 3.7, LOW (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/waysact/webpack-subresource-integrity
commit_details: repo_url: https://github.com/waysact/webpack-subresource-integrity
author: Julian Scheid
author_date: 2020-10-18 17:46:46+13:00
msg: Fix hash lookup for dynamic chunks

Closes #131
repository: repo_url: https://github.com/waysact/webpack-subresource-integrity
repo_name: waysact/webpack-subresource-integrity
description: Webpack plugin for enabling Subresource Integrity.
repo_language: TypeScript
owner: waysact
file_changes: filename: README.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+# With a modified dynamically loaded chunk #hwp
+
+Ensure that when a chunk is modified, it fails to load.

programming_language: Markdown
filename: corrupt.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+console.log('this should never load');

programming_language: Batchfile
filename: index.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,5 @@
+import("./corrupt").then(function error() {
+  console.log('error');
+}).catch(function ok() {
+  console.log('ok');
+});

programming_language: JavaScript
filename: test.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,18 @@
+var webpackVersionComponents = require('webpack/package.json').version.split(
+  '.'
+);
+var webpackVersionMajor = Number(webpackVersionComponents[0]);
+
+var defaultCheck = require("../../test/defaultCheck");
+var fs = require('fs');
+
+module.exports.skip = function skip() {
+  return webpackVersionMajor < 2;
+};
+
+module.exports.check = function check(stats, url, browser) {
+  const otherAsset = Object.keys(stats.compilation.assets).find(key => key !== 'index.js' && key.endsWith(".js"));
+  fs.writeFileSync('dist/' + otherAsset, 'xxx');
+
+  return defaultCheck(stats, url, browser);
+};

programming_language: JavaScript
filename: webpack.config.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,18 @@
+var SriPlugin = require('webpack-subresource-integrity');
+var HtmlWebpackPlugin = require('html-webpack-plugin');
+
+module.exports = {
+  entry: {
+    index: './index.js'
+  },
+  output: {
+    crossOriginLoading: 'anonymous'
+  },
+  plugins: [
+    new SriPlugin({
+      hashFuncNames: ['sha256', 'sha384'],
+      enabled: true
+    }),
+    new HtmlWebpackPlugin()
+  ]
+};

programming_language: JavaScript
filename: jmtp.js
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,10 @@
 
 var Template = require('webpack/lib/Template');
 var util = require('./util');
+var webpackVersionComponents = require('webpack/package.json').version.split(
+  '.'
+);
+var webpackVersionMajor = Number(webpackVersionComponents[0]);
 
 function WebIntegrityJsonpMainTemplatePlugin(sriPlugin, compilation) {
   this.sriPlugin = sriPlugin;
@@ -47,7 +51,7 @@ WebIntegrityJsonpMainTemplatePlugin.prototype.addSriHashes =
  *  Patch jsonp-script code to add the integrity attribute.
  */
 WebIntegrityJsonpMainTemplatePlugin.prototype.addAttribute =
-  function addAttribute(mainTemplate, elName, source, chunk) {
+  function addAttribute(mainTemplate, elName, source) {
     const outputOptions = this.compilation.outputOptions || mainTemplate.outputOptions;
     if (!outputOptions.crossOriginLoading) {
       this.sriPlugin.errorOnce(
@@ -55,9 +59,12 @@ WebIntegrityJsonpMainTemplatePlugin.prototype.addAttribute =
         'webpack option output.crossOriginLoading not set, code splitting will not work!'
       );
     }
+
     return (Template.asString || mainTemplate.asString)([
       source,
-      elName + '.integrity = __webpack_require__.sriHashes[' + (chunk ? `'${chunk.id}'` : 'chunkId') + '];',
+      elName + '.integrity = __webpack_require__.sriHashes[' +
+        ((webpackVersionMajor >= 5 && elName === 'script') ? 'key.match(/^chunk-([0-9]+)$/)[1]' : 'chunkId') +
+        '];',
       elName + '.crossOrigin = ' + JSON.stringify(outputOptions.crossOriginLoading) + ';',
     ]);
   };

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "webpack-subresource-integrity",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Webpack plugin for enabling Subresource Integrity",
   "engines": {
     "node": ">=4"

programming_language: Jupyter Notebook