feat: extract sri from fetch, upgrade to latest spec #4307
Conversation
|
I am kind of dissappointed of the latest spec. |
| */ | ||
| const applyAlgorithmToBytes = crypto.hash | ||
| ? /** @type {ApplyAlgorithmToBytes} */ (algorithm, bytes) => { | ||
| return crypto.hash(algorithm, bytes, 'base64') |
There was a problem hiding this comment.
Will this cause an ExperimentalWarning on node v20? If not, crypto.hash is available in all versions of node undici supports. If it does, we should only use createHash for now.
There was a problem hiding this comment.
I didnt see any ExperimentalWarning on node 20.19.2
There was a problem hiding this comment.
crypto.hash will be available on all supported versions of node then, we don't need the fallback
| // See https://github.com/web-platform-tests/wpt/commit/e4c5cc7a5e48093220528dfdd1c4012dc3837a0e | ||
| // "be liberal with padding". This is annoying, and it's not even in the spec. |
There was a problem hiding this comment.
Can you file an issue? I agree we want that tackled. It's very annoying, but Firefox was perceived as "incompatible" because the implementation in Chrome was more permissive and websites didn't work outside of Chrome. They couldn't easily go through an deprecation, so we had to budge.
The way we do this (iirc), is to decode all of the values liberally (base64, base64url with/without padding) and compare raw bytes
There was a problem hiding this comment.
Whoa! That is of course smarter?!
|
I think we can review and merge it. The problems with base64url are well known. |
No description provided.