Initial add

.gitignore

@@ -0,0 +1,2 @@
+node_modules
+coverage

LICENSE

@@ -0,0 +1,5 @@
+Copyright 2020-present Aral Balkan, Small Technology Foundation
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

README.md

@@ -0,0 +1,53 @@
+# @small-tech/vite-plugin-sri
+
+[Subresource integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) (SRI) plugin for [Vite](https://vitejs.dev/).
+
+Adds subresource integrity hashes to script and stylesheet imports from your _index.html_ at build time.
+
+## Install
+
+```shell
+npm i --save-dev @small-tech/vite-plugin-sri
+```
+
+## Use
+
+In your `vite.config.js` file:
+
+```js
+import { defineConfig } from 'vite'
+import sri from '@small-tech/vite-plugin-sri'
+
+export default defineConfig({
+  // …
+  plugins: [sri()]
+})
+```
+
+Then:
+
+```shell
+npx vite build
+```
+
+## Test and coverage
+
+Run `npm test` to test, `npm run coverage` to run coverage.
+
+## See also
+
+If you’re looking for a generic Rollup plugin that does the same thing, see [rollup-plugin-sri](https://github.com/JonasKruckenberg/rollup-plugin-sri) by [Jonas Kruckenberg](https://github.com/JonasKruckenberg) that this one was inspired by.
+
+## Like this? Fund us!
+
+[Small Technology Foundation](https://small-tech.org) is a tiny, independent not-for-profit.
+
+We exist in part thanks to patronage by people like you. If you share [our vision](https://small-tech.org/about/#small-technology) and want to support our work, please [become a patron or donate to us](https://small-tech.org/fund-us) today and help us continue to exist.
+
+## Copyright
+
+Copyright © 2021-present [Aral Balkan](https://ar.al), [Small Technology Foundation](https://small-tech.org).
+
+## License
+
+[ISC](./LICENSE).

index.js

@@ -0,0 +1,68 @@
+////////////////////////////////////////////////////////////////////////////////
+//
+// @small-tech/vite-plugin-sri
+//
+// Subresource integrity (SRI) plugin for Vite (https://vitejs.dev/)
+//
+// Adds subresource integrity hashes to script and stylesheet
+// imports from your index.html at build time.
+//
+// If you’re looking for a generic Rollup plugin that does the same thing,
+// see rollup-plugin-sri by Jonas Kruckenberg that this one was inspired by:
+// https://github.com/JonasKruckenberg/rollup-plugin-sri
+//
+// Like this? Fund us!
+// https://small-tech.org/fund-us
+//
+// Copyright ⓒ 2021-present Aral Balkan, Small Technology Foundation
+// License: ISC.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+import { createHash } from 'crypto'
+import cheerio from 'cheerio'
+import fetch from 'node-fetch'
+
+export default function sri () {
+  return {
+    name: 'vite-plugin-sri',
+    enforce: 'post',
+    apply: 'build',
+
+    async transformIndexHtml(html, context) {
+      const bundle = context.bundle
+
+      const calculateIntegrityHashes = async (element) => {
+        let source
+        let attributeName = element.attribs.src ? 'src' : 'href'
+        const resourcePath = element.attribs[attributeName]
+        if (resourcePath.startsWith('http')) {
+          // Load remote source from URL.
+          source = await (await fetch(resourcePath)).buffer()
+        } else {
+          // Load local source from bundle.
+          const resourcePathWithoutLeadingSlash = element.attribs[attributeName].slice(1)
+          const bundleItem = bundle[resourcePathWithoutLeadingSlash]
+          source = bundleItem.code || bundleItem.source
+        }
+        element.attribs.integrity = `sha384-${createHash('sha384').update(source).digest().toString('base64')}`
+      }
+
+      const $ = cheerio.load(html)
+      $.prototype.asyncForEach = async function (callback) {
+        for (let index = 0; index < this.length; index++) {
+          await callback(this[index], index, this);
+        }
+      }
+
+      // Implement SRI for scripts and stylesheets.
+      const scripts = $('script').filter('[src]')
+      const stylesheets = $('link[rel=stylesheet]').filter('[href]')
+
+      await scripts.asyncForEach(calculateIntegrityHashes)
+      await stylesheets.asyncForEach(calculateIntegrityHashes)
+
+      return $.html()
+    }
+  }
+}