Warning for 'integrity' attribute, unknown error while trying to verify integrity with `experimentalSourceRewriting` on

Test code to reproduce the issue

it('fails to pass SRI', function () {
  cy.visit('https://mail.protonmail.com/login')
})

Current behavior:

When running Cypress against the site, resources on the page are immediately blocked due to invalid hashes and Cypress crashing.

Console error:

Versions:

Cypress 4.6.0 Chrome 81.0.4044.138 macOS Catalina 10.15.13

cypress-crash-log.txt

[jennifer-shehane]

Thanks for opening an issue and providing a reproducible example!

I can recreate the issue and verify that passing experimentalSourceRewriting to true does not resolve the original integrity issue from #2393.

it('fails to pass SRI', () => {
  cy.visit('https://mail.protonmail.com/login')
})

4.6.0 with experimentalSourceRewriting: false

Failed to find a valid digest in the ‘integrity’ attribute for resource ‘https://mail.protonmail.com/9.4a8bc1d8ab.chunk.js’ with computed SHA-256 integrity ‘duD4TSuSwqCtKe2Nmu/LdEGYR/fxs4A55+Rhjl6AUjw=’. The resource has been blocked.

Script tags

<script 
  type=text/javascript 
  src=vendors~index.43850aa473.chunk.js 
  defer=defer 
  integrity=sha384-6lkdxYt9QNm3HPmqy8GQe+yRXaYuQNcRL6vBXH+luSCFNfRMgl42/nZtikZpSp6Z 
  crossorigin=anonymous></script>
<script 
  type=text/javascript 
  src=index.36da68f082.js 
  defer=defer 
  integrity=sha384-gBxPomvRfn4tUtCdIyP34p4Uc7wr4Q8oee+G4k2fKXw3fCOH7X1cTBrD4iNnNtoa 
  crossorigin=anonymous></script>

4.6.0 with experimentalSourceRewriting: true

Failed to find a valid digest in the ‘integrity’ attribute for resource ‘https://mail.protonmail.com/openpgp.worker.min.5640aaebbced65f397acfa772ec10501a3dfbec5.js’ with computed SHA-256 integrity ‘K45XrRvdkoerxKLkoocmu2/I1JSeE3DfqdWpYs5z9mg=’. The resource has been blocked. Unknown error occurred while trying to verify integrity.

Script tags

The SHA’s are actually the same in the stripped version as the non-stripped.

<script 
  type="text/javascript" 
  src="vendors~index.43850aa473.chunk.js" 
  defer="defer" 
  cypress:stripped-integrity="sha384-6lkdxYt9QNm3HPmqy8GQe+yRXaYuQNcRL6vBXH+luSCFNfRMgl42/nZtikZpSp6Z" 
  crossorigin="anonymous"></script>
<script 
  type="text/javascript" 
  src="index.36da68f082.js" 
  defer="defer" 
  cypress:stripped-integrity="sha384-gBxPomvRfn4tUtCdIyP34p4Uc7wr4Q8oee+G4k2fKXw3fCOH7X1cTBrD4iNnNtoa" 
  crossorigin="anonymous"></script>

[flotwig]

I suppose we could attempt to rewrite all calls to window.fetch and fetch so that the integrity property is ignored (with experimentalSourceRewriting: true). Outside of that, I don’t see a solution.