thymeleaf/thymeleaf.github.io

Consider adding th:integrity attribute into HTML <script> and <link> tags

wkaczurba opened this issue · 4 comments

wkaczurba commented

Hello,

I used webjars's jquery and it had different SRI than original file from CDN. (webjars contain one additional line, as in the issue here: webjars/jquery#50 ).
One of the solutions would be to provide th:integrity for <script>.

Now I now it sounds risky... but different SRIs prevent me from using CDN (offline browsing) and Webjars (Spring-boot) at the same time.

Rgds,
VIto

danielfernandez commented

Actually, Thymeleaf 3.0 allows any attribute to be rendered even if there is not a specific processor for it in the standard dialect. So th:integrity="${something}" should work for you and create a nice integrity="value_of_something" attribute...

Is there a reason why this wouldn't be enough for your needs?

wkaczurba commented

Hi

This is working fine and enough for my needs. Please close this issue.

Many thanks
Cheers
Vito

rjclancy commented

That tag doesnt seem to work for 2.7.10, i'm trying to add a dynamic value i.e th:integrity="sha-IGUyjq0U2UrzovhZW"

Error: Exception evaluating SpringEL expression

rjclancy commented

Ok, managed to get this working with th:attr="integrity=${@environment.getProperty('someProprty')}"