Add integrity checksums

lib/interfaces/swagger-custom-options.interface.ts

@@ -2,14 +2,29 @@ import { SwaggerUiOptions } from './swagger-ui-options.interface';
 import { SwaggerDocumentOptions } from './swagger-document-options.interface';
 import { OpenAPIObject } from './open-api-spec.interface';
 
+export interface CustomCssUrl {
+  customCssUrl: string | string[];
+  customCssUrlIntegrity?: string | string[];
+}
+
+export interface CustomJs {
+  customJs: string | string[];
+  customJsIntegrity?: string | string[];
+}
+
+export interface CustomJsStr {
+  customJsStr: string | string[];
+  customJsStrIntegrity?: string | string[];
+}
+
 export interface SwaggerCustomOptions {
   useGlobalPrefix?: boolean;
   explorer?: boolean;
   swaggerOptions?: SwaggerUiOptions;
   customCss?: string;
-  customCssUrl?: string | string[];
-  customJs?: string | string[];
-  customJsStr?: string | string[];
+  customCssUrl?: CustomCssUrl;
+  customJs?: CustomJs;
+  customJsStr?: CustomJsStr;
   customfavIcon?: string;
   customSwaggerUiPath?: string;
   swaggerUrl?: string;
@@ -19,5 +34,9 @@ export interface SwaggerCustomOptions {
   urls?: Record<'url' | 'name', string>[];
   jsonDocumentUrl?: string;
   yamlDocumentUrl?: string;
-  patchDocumentOnRequest?: <TRequest = any, TResponse = any> (req: TRequest, res: TResponse, document: OpenAPIObject) => OpenAPIObject;
+  patchDocumentOnRequest?: <TRequest = any, TResponse = any>(
+    req: TRequest,
+    res: TResponse,
+    document: OpenAPIObject
+  ) => OpenAPIObject;
 }

lib/swagger-ui/constants.ts

@@ -70,8 +70,8 @@ export const htmlTemplateString = `
 
 <div id="swagger-ui"></div>
 
-<script src="<% baseUrl %>swagger-ui-bundle.js"> </script>
-<script src="<% baseUrl %>swagger-ui-standalone-preset.js"> </script>
+<script src="<% baseUrl %>swagger-ui-bundle.js" integrity="sha384-yrdF3mlUytUBwQyEVFAdwuUKEC9Qqrf+IUCgFgho4O5O6irf77pMjv36FN4eTpQD"> </script>
+<script src="<% baseUrl %>swagger-ui-standalone-preset.js" integrity="sha384-azzkurII4f+bjmZvm3hWhj7JezshyXtwobwneRyWCCIksK61Xi0Ry3xA2am9/TWp"> </script>
 <script src="<% baseUrl %>swagger-ui-init.js"> </script>
 <% customJs %>
 <% customJsStr %>

lib/swagger-ui/swagger-ui.ts

@@ -17,6 +17,7 @@ export function buildSwaggerInitJS(
   };
 
   const jsInitOptions = buildJSInitOptions(swaggerInitOptions);
+  // Cannot dynamically compute integrity: https://github.com/nestjs/swagger/issues/2667#issuecomment-1780515512
   return jsTemplateString.replace('<% swaggerOptions %>', jsInitOptions);
 }
 
@@ -34,20 +35,30 @@ export function getSwaggerAssetsAbsoluteFSPath() {
   return swaggerAssetsAbsoluteFSPath;
 }
 
-function toExternalScriptTag(url: string) {
-  return `<script src='${url}'></script>`;
+function toExternalScriptTag(url: string, integrity?: string) {
+  // Cannot dynamically compute integrity: https://github.com/nestjs/swagger/issues/2667#issuecomment-1780515512
+  return `<script src='${url}' ${
+    !!integrity ? `integrity="${integrity}"` : ''
+  }></script>`.replace(/\s+>/g, '>');
 }
 
-function toInlineScriptTag(jsCode: string) {
-  return `<script>${jsCode}</script>`;
+function toInlineScriptTag(jsCode: string, integrity?: string) {
+  // Cannot dynamically compute integrity: https://github.com/nestjs/swagger/issues/2667#issuecomment-1780515512
+  return `<script ${
+    !!integrity ? `integrity="${integrity}"` : ''
+  }>${jsCode}</script>`.replace(/\s+>/g, '>');
 }
 
-function toExternalStylesheetTag(url: string) {
-  return `<link href='${url}' rel='stylesheet'>`;
+function toExternalStylesheetTag(url: string, integrity?: string) {
+  // Cannot dynamically compute integrity: https://github.com/nestjs/swagger/issues/2667#issuecomment-1780515512
+  return `<link href='${url}' rel='stylesheet' ${
+    !!integrity ? `integrity="${integrity}"` : ''
+  }>`.replace(/\s+>/g, '>');
 }
 
 function toTags(
   customCode: string | string[] | undefined,
+  integrity: typeof customCode,
   toScript: (url: string) => string
 ) {
   if (!customCode) {
@@ -71,11 +82,11 @@ export function buildSwaggerHTML(
 ) {
   const {
     customCss = '',
-    customJs = '',
-    customJsStr = '',
+    customJs: { customJs = '', customJsIntegrity = null },
+    customJsStr: { customJsStr = '', customJsStrIntegrity = null },
     customfavIcon = false,
     customSiteTitle = 'Swagger UI',
-    customCssUrl = '',
+    customCssUrl: { customCssUrl = '', customCssUrlIntegrity = null },
     explorer = false
   } = customOptions;
 
@@ -91,11 +102,17 @@ export function buildSwaggerHTML(
     .replace('<% explorerCss %>', explorerCss)
     .replace('<% favIconString %>', favIconString)
     .replace(/<% baseUrl %>/g, baseUrl)
-    .replace('<% customJs %>', toTags(customJs, toExternalScriptTag))
-    .replace('<% customJsStr %>', toTags(customJsStr, toInlineScriptTag))
+    .replace(
+      '<% customJs %>',
+      toTags(customJs, customJsIntegrity, toExternalScriptTag)
+    )
+    .replace(
+      '<% customJsStr %>',
+      toTags(customJsStr, customJsStrIntegrity, toInlineScriptTag)
+    )
     .replace(
       '<% customCssUrl %>',
-      toTags(customCssUrl, toExternalStylesheetTag)
+      toTags(customCssUrl, customCssUrlIntegrity, toExternalStylesheetTag)
     )
     .replace('<% title %>', customSiteTitle);
 }

package.json

@@ -18,6 +18,9 @@
     "test:e2e": "jest --config e2e/jest-e2e.json",
     "prerelease": "npm run build",
     "release": "release-it",
+    "checksum-file": "echo \"$1:\t$(cat $1 | openssl dgst -sha384 -binary | openssl base64 -A)\"",
+    "checksum-url": "echo \"$1:\t$(curl -s $1 | openssl dgst -sha384 -binary | openssl base64 -A)\"",
+    "checksum-swagger": "for jsFile in 'swagger-ui-bundle' 'swagger-ui-standalone-preset' 'swagger-ui-init'; do echo \"$jsFile:\t$(curl -s https://raw.githubusercontent.com/swagger-api/swagger-ui/v$(cat package.json | jq -r '.dependencies.\"swagger-ui-dist\"')/dist/$jsFile.js | openssl dgst -sha384 -binary | openssl base64 -A)\"; done",
     "---manual-tests---": "",
     "start": "nest start",
     "start:dev": "nest start --watch",
@@ -93,4 +96,4 @@
       "commit-msg": "commitlint -c .commitlintrc.json -E HUSKY_GIT_PARAMS"
     }
   }
-}
+}