Insecure reference to external resources
Why is this an issue?
When loading resources from external sources (e.g. from CDNs), there is no guarantee the content has not been tampered with. Subresource Integrity (SRI) allows browsers to verify that fetched resources are delivered without unexpected modification.
Without SRI, a compromised external source could serve malicious code to your application.
Examples
Example of incorrect code:
<script src="https://cdn.example.com/library.js"></script>
Example of correct code with SRI:
<script src="https://cdn.example.com/library.js"
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
crossorigin="anonymous"></script>
How can I fix violations?
Use static resources: The preferred approach is to host scripts as Salesforce static resources.
Add integrity attribute: If external resources are necessary, add the
integrityattribute with a hash of the expected content.Generate SRI hashes: Use tools like srihash.org to generate integrity hashes.
When should I disable this rule?
You may dismiss specific violations when the external resource does not support SRI (rare for modern CDNs) and you have other mitigations in place.
Resources